Vulnerability · Published Jun 19, 2026 · Assigned by snyk
CVE-2026-12644
Medium 5.3
In plain English
A medium-severity security flaw in ts-deepmerge. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf). When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken — any string context operation throws a TypeError, crashing the application.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | ts-deepmerge | 8.0.0 | GHSA-87mf-gv2c-c62c |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | ts-deepmerge | 0 – before 8.0.0 |
Weakness: CWE-248 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P