CVE-2026-12644

Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods such as toString, valueOf. When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken —...

CVE-2026-12644

The CVE affects ts-deepmerge before version 8.0.0. The vulnerability stems from improper handling of built-in Object.prototype methods (e.g., toString, valueOf) during merging. If user-controlled input supplies these keys with non-function values, the merged object can break and throw a TypeError...