Prisma 7.10.0 pins deepmerge-ts 7.1.5 and mysql2 3.15.3, which carry high-severity npm audit advisories
Author: wmadden-electricCreated Sep 15, 2026Updated Sep 15, 2026
Package and version
[email protected] and @prisma/[email protected]
What happened?
npm audit on a project using the latest Prisma 7 reports four high-severity findings, all in dependencies pinned by Prisma packages:
@prisma/config7.10.0 pins[email protected]. GHSA-ggr8-5vv4-36mx (stack exhaustion when merging recursive object graphs) is fixed in[email protected].prisma7.10.0 pins[email protected]. GHSA-3f6p-5ww8-9rcr (auth plugin downgrade leaking plaintext credentials) is fixed in[email protected], and GHSA-rgwj-5xj2-c3m3 (unbounded zlib inflate in the compressed protocol handler) is fixed in[email protected].
The only fix npm audit fix --force offers is a downgrade to [email protected].
Reported by a user on the Prisma Discord: https://discord.com/channels/937751382725886062/1548958064810393601/1549149135098675200
What did you expect to happen?
A clean npm audit on the current Prisma 7 release, with deepmerge-ts at 8.x and mysql2 at 3.23.1 or later.
Minimal reproduction
mkdir audit-repro && cd audit-repro
npm init -y
npm install [email protected]
npm audit
Environment
- Package manager: npm
- Prisma: 7.10.0 (latest 7.x at the time of filing)
- Database: MySQL and SQLite, per the reporter; the findings do not depend on the database in use
Additional context
The advisories are public and are in transitive dependencies, not in Prisma itself. These are pinned exact versions, so users cannot override them without overrides.
Source: prisma/prisma