PT-2026-50839 · Npm · Ts-Deepmerge
CVSS v4.0
5.5
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P |
Name of the Vulnerable Software and Affected Versions
ts-deepmerge versions prior to 8.0.0
Description
An uncaught exception occurs due to improper handling of built-in Object.prototype methods, such as
toString and valueOf. When user-controlled input contains these keys with non-function values, the resulting merged object is corrupted. Consequently, any string context operation triggers a TypeError, which leads to an application crash.Recommendations
Update to version 8.0.0 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ts-Deepmerge