CVE-2026-40345
Received Received - Intake

Prototype Pollution in deepmerge-ts Library

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values contain self-references at the same property path, the merge logic repeatedly revisits the same pair until Node.js raises RangeError: Maximum call stack size exceeded. Applications that merge attacker-controlled recursive object graphs can synchronously crash the affected process or cause repeated worker restarts. Plain JSON input alone cannot create the recursive graph required to trigger the issue. This issue is fixed in version 8.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-40345
EUVD
EUVD-2026-63468

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the deepmerge-ts library before version 8.0.0. The deepmerge functions do not track visited objects during recursive merging, allowing self-referencing objects to cause infinite loops. This leads to stack exhaustion and crashes in Node.js applications.

Detection Guidance

To detect this vulnerability, check if your system uses deepmerge-ts versions prior to 8.0.0. Run: npm list deepmerge-ts or grep -r "deepmerge-ts" in your project directories. If vulnerable versions are found, update to v8.0.0 or later immediately.

Impact Analysis

Applications using vulnerable versions of deepmerge-ts may crash when merging attacker-controlled recursive objects. This can terminate request handling or cause repeated worker restarts, disrupting service availability.

Compliance Impact

This vulnerability primarily impacts system availability by causing synchronous crashes or worker restarts in Node.js services. While it does not directly expose or leak data, compliance risks arise from potential service disruptions that could affect data processing or access, particularly in environments where continuous uptime is required for regulatory compliance.

Mitigation Strategies

Upgrade deepmerge-ts to version 8.0.0 or later using npm update deepmerge-ts. If immediate upgrade is not possible, restrict input validation to prevent recursive object graphs or disable affected APIs until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40345. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart