Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

deepmerge-ts

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2npmPublished

    DeepmergeTS has stack exhaustion when merging recursive object graphs

    CVE-2026-40345 · GHSA-ggr8-5vv4-36mx

    Affected
    • npm deepmerge-ts < 8.0.0
    Fixed in
    8.0.0· Vendor fix available
    Issue
    deepmerge() and deepmergeInto() can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws RangeError: Maximum call stack size exceeded. Details Record merging is implemented recursively. For each enumerable key, the library collects the values from every input object and immediately calls the same merge routine on that property. There is no visited-object tracking, pair tracking, or cycle detection in that recursion. As a result, if two merged records both point back to themselves through the same key path, the merge logic keeps revisiting the same object pair forever. This is reachable through the real public API: deepmerge(...) deepmergeCustom(...)(...) deepmergeInto(target, ...) deepmergeIntoCustom(...)(target, ...) The issue only occurs when recursive object graphs are supplied. Plain JSON alone does not create this condition. PoC Impact Applications that pass…

    Recommended action: Upgrade to 8.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. High, CVSS 8.1npmAmendedPublished

    Prototype Pollution in deepmerge-ts

    CVE-2022-24802 · GHSA-r9w3-g83q-m6hq

    Affected
    • npm deepmerge-ts < 4.0.2
    Fixed in
    4.0.2· Vendor fix available
    Issue
    deepmerge-ts is used to merge 2 or more objects respecting type information. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). A fix was released in version 4.0.2. Currently, there is no known workaround.

    Recommended action: Upgrade to 4.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →