The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below.
CVSS 3.1HIGH 7.5·Network·No auth·No interaction·EPSS 0.01539·Published 2021-01-31·Fixed in 1.0.4CWE-1321