Read the docs
TI-2026-29120 Aliases CVE-2026-40345GHSA-ggr8-5vv4-36mx

deepmerge-ts: Stack exhaustion when merging recursive object graphs

Priority HIGH 69CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-674.

Summary

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values contain self-references at the same property path, the merge logic repeatedly revisits the same pair until Node.js raises RangeError: Maximum call stack size exceeded. Applications that merge attacker-controlled recursive object graphs can synchronously crash the affected process or cause repeated worker restarts. Plain JSON input alone cannot create the recursive graph required to trigger the issue. This issue is fixed in version 8.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00524 44th percentileScored 2026-11-07
Fix Fixed deepmerge-ts (RebeccaStevens): 8.0.0deepmerge-ts (npm): 8.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RebeccaStevensdeepmerge-tsbefore 8.0.08.0.0Patch availableCNA
—deepmerge-ts (npm)before 8.0.08.0.0Patch availableGHSA-ggr8-5vv4-36mx
  • deepmerge-ts VendorRebeccaStevens Affected before 8.0.0 Fixed in 8.0.0 Patch available CNA
  • deepmerge-ts (npm) Vendor— Affected before 8.0.0 Fixed in 8.0.0 Patch available GHSA-ggr8-5vv4-36mx

Remediation

  • Fix · CNA deepmerge-ts (RebeccaStevens) Fixed in 8.0.0
  • Fix · GHSA-ggr8-5vv4-36mx deepmerge-ts (npm) Fixed in 8.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40345
  2. 2026-10-03 Alias added: GHSA-ggr8-5vv4-36mx

References

Sources