CVE-2026-12644

Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods such as toString, valueOf. When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken —...

2broke2wait (0.1.0), @7i7o/wc-strategy-beta (0.0.1-beta) +988 more potentially affected by CVE-2026-12644 via ts-deepmerge (>=1.0.5, <=7.0.3)

ts-deepmerge NPM version =1.0.5, =0.2.0, =0.1.22, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.2, =1.0.0, =1.0.2, =1.0.0, =1.0.0, =1.0.0, =1.0.9 and more Source cves: CVE-2026-12644 Source advisory: MEND:CVE-2026-12644...

CVE-2026-12644

The CVE affects ts-deepmerge before version 8.0.0. The vulnerability stems from improper handling of built-in Object.prototype methods (e.g., toString, valueOf) during merging. If user-controlled input supplies these keys with non-function values, the merged object can break and throw a TypeError...

CVE-2026-12644

Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods such as toString, valueOf. When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken —...