The `mergeDeep()` function in the GraphQL Tools utils package fails to exclude ` proto `, `constructor`, or `prototype` keys while recursively merging source objects. An unauthenticated client can alias fields to these names, causing responses from two subgraphs to collide during supergraph result merging. This allows the function to traverse Object and Function prototypes and overwrite `Function.prototype.call` with a value supplied by a subgraph, resulting in a denial of service that breaks all subsequent requests until the process is restarted.