fkie_cve-2026-40345

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values contain self-references at the same property path, the merge logic repeatedly revisits the same pair until Node.js raises RangeError: Maximum call stack size exceeded. Applications that merge attacker-controlled recursive object graphs can synchronously crash the affected process or cause repeated worker restarts. Plain JSON input alone cannot create the recursive graph required to trigger the issue. This issue is fixed in version 8.0.0.

GHSA-ggr8-5vv4-36mx — DeepmergeTS has stack exhaustion when merging recursive object graphs

Affected: npm: deepmerge-ts

### Summary

`deepmerge()` and `deepmergeInto()` can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws `RangeError: Maximum call stack size exceeded`.

### Details

Record merging is implemented recursively. For each enumerable key, the library collects the values from every input object and immediately calls the same merge routine on that property.

There is no visited-object tracking, pair tracking, or cycle detection in that recursion. As a result, if two merged records both point back to themselves through the same key path, the merge logic keeps revisiting the same object pair forever.

This is reachable through the real public API:

* `deepmerge(...)` * `deepmergeCustom(...)(...)` * `deepmergeInto(target, ...)` * `deepmergeIntoCustom(...)(target, ...)`

The issue only occurs when recursive object graphs are supplied. Plain JSON alone does not create this condition.

### PoC

```js import { deepmerge, deepmergeInto } from "deepmerge-ts";

const left = {}; left.self = left;

const right = {}; right.self = right;

try { deepmerge(left, right); } catch (error) { console.log(error.name, error.message); // Expected: the merge should reject or safely handle recursive input without exhausting the stack. // Vulnerable behavior: RangeError Maximum call stack size exceeded }

const target = {}; target.self = target;

const source = {}; source.self = source;

t…

Most recent entries from all

fkie_cve-2026-40345

GHSA-ggr8-5vv4-36mx — DeepmergeTS has stack exhaustion when merging recursive object graphs