ts-deepmerge: Prototype Method Override leads to DoS

Description

Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf).

Recommendation

Update the ts-deepmerge package to the latest compatible version. Followings are version details:

• Affected version(s): < 8.0.0
• Patched version(s): 8.0.0

References

• GHSA-87mf-gv2c-c62c
• security.snyk.io
• CVE-2026-12644
• CWE-248
• CAPEC-310
• OWASP 2021-A6

Related Issues

• axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490
• Qwik City has array method pollution in FormData processing allows type confusion and DoS - CVE-2026-32701
• xmldom: Uncontrolled recursion in XML serialization leads to DoS - xmldom - CVE-2026-41673
• xmldom: Uncontrolled recursion in XML serialization leads to DoS - CVE-2026-41673

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

ts-deepmerge