Daily security quiz #9

Question for 2026-11-09. Read the code and pick the most serious security vulnerability.

This function merges user settings with defaults. body is the request JSON. What is the most serious vulnerability?

1function merge(target, source) {
2  for (const key in source) {
3    if (typeof source[key] === 'object' && source[key] !== null) {
4      target[key] = merge(target[key] ?? {}, source[key]);
5    } else {
6      target[key] = source[key];
7    }
8  }
9  return target;
10}
11 
12const settings = merge({}, req.body);

1. ADeep recursion can cause a stack overflow
2. BThe __proto__ key can change the default properties of all objects (prototype pollution)
3. CArrays become objects
4. Dfor...in does not guarantee order