PT-2026-76717 · Npm · Ts-Deepmerge
CVE-2026-40345
·
Published
2026-08-17
·
Updated
2026-08-20
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
deepmerge-ts versions prior to 8.0.0
Description
The library fails to track visited objects or object pairs during the recursive merging of records. When two input values contain self-references at the same property path, the merge logic repeatedly revisits the same pair, leading to a
RangeError: Maximum call stack size exceeded in Node.js. This can be triggered via the deepmerge(), deepmergeCustom(), deepmergeInto(), and deepmergeIntoCustom() APIs. Applications processing attacker-controlled recursive object graphs may experience synchronous process crashes or repeated worker restarts. This condition cannot be triggered using plain JSON input alone.Recommendations
Update to version 8.0.0.
Exploit
Fix
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ts-Deepmerge