CVE-2026-12644

Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods such as toString, valueOf. When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken —...

@alloyify/anvil (>=1.1.2 <=1.1.4), @alloyify/devkit (>=1.1.2 <=1.1.4) +68 more potentially affected by CVE-2022-25907 via ts-deepmerge (>=1.0.5 <=2.0.1)

ts-deepmerge NPM version =1.0.5, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =0.0.2, =0.2.0, =0.1.1, =2.4.6-alpha.3, =1.1.0, =0.1.0, =0.12.2, =0.0.1, =1.0.0-beta.1, =1.0.6 and more Source cves: CVE-2022-25907 Source advisory: OSV:GHSA-7QQQ-GH2F-WQ76...