CVE-2026-40345

deepmerge-ts mergeleft.self, right.self - mergeleft.self, right.self - mergeleft.self, right.self...

react-cve-2025-55182

CVE-2025-55182: React/Next.js Test Project Status: Experimental / Proof of Concept This repository serves as a controlled research environment and Proof-of-Concept PoC framework for analyzing CVE-2025-55182. It demonstrates a Prototype Pollution vulnerability within the context of Next.js Server...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via its transitive dependency on deepmerge, which is affected by CVE-2026-93753. When sanitize-html merges configuration objects combining tag-specific and wildcard allowedClasses or allowedStyles entries, the...

Uncontrolled Recursion

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Uncontrolled Recursion via its transitive dependency on deepmerge, which is...

CLSA-2026-1792490574 TuxCare security update for ts-deepmerge (1 CVE)

TuxCare rebuilt ts-deepmerge to address 1 CVE. Fixed in 7.0.2-tuxcare.1...

CLSA-2026-1792476546 TuxCare security update for deepmerge-ts (1 CVE)

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 5.1.0-tuxcare.1...

CLSA-2026-1792473266 TuxCare security update for ts-deepmerge (1 CVE)

TuxCare rebuilt ts-deepmerge to address 1 CVE. Fixed in 7.0.0-tuxcare.1...

CVE-2026-93753

A flaw was found in deepmerge. This vulnerability, known as prototype poisoning, allows an attacker to inject malicious properties into an application's object prototype. This occurs in the mergeObject function due to insufficient validation of keys during object merging. By supplying specially...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Uncontrolled Recursion due to Node.js module deepmerge-ts ( CVE-2026-40345 )

Summary IBM App Connect Enterprise Discovery Connectors is vulnerable to Uncontrolled Recursion due to Node.js module deepmerge-ts. Vulnerability Details CVEID:CVE-2026-40345 DESCRIPTION: deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to...

CLSA-2026-1790870726 TuxCare security update for deepmerge-ts (1 CVE)

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 7.1.5-tuxcare.1...

PT-2026-110307

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 7.1.5-tuxcare.1...

CLSA-2026-1790609747 TuxCare security update for deepmerge-ts (1 CVE)

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 7.1.6-tuxcare.1...

PT-2026-108091

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 7.1.6-tuxcare.1...

CLSA-2026-1790420043 TuxCare security update for deepmerge-ts (1 CVE)

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 4.3.0-tuxcare.1...

PT-2026-106813

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 4.3.0-tuxcare.1...

SUSE CVE-2026-93753

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

Linux Distros Unpatched Vulnerability : CVE-2026-93753

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via mergeObject, which fails to validate keys before writing them to target objects. An attacker can supply a malicious source object containing a proto key in a merge operation, injecting attacker-controlled...

GHSA-GCQX-W48M-W2H4 deepmerge mergeObject() allows prototype poisoning of returned objects

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...

deepmerge mergeObject() allows prototype poisoning of returned objects

deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...