Npm · Ts-Deepmerge · CVE-2026-12644
**Name of the Vulnerable Software and Affected Versions**
ts-deepmerge versions prior to 8.0.0
**Description**
An uncaught exception occurs due to improper handling of built-in Object.prototype methods, such as `toString` and `valueOf`. When user-controlled input contains these keys with non-function values, the resulting merged object is corrupted. Consequently, any string context operation triggers a TypeError, which leads to an application crash.
**Recommendations**
Update to version 8.0.0 or later.