CVE-2026-40345

deepmerge-ts mergeleft.self, right.self - mergeleft.self, right.self - mergeleft.self, right.self...

react-cve-2025-55182

CVE-2025-55182: React/Next.js Test Project Status: Experimental / Proof of Concept This repository serves as a controlled research environment and Proof-of-Concept PoC framework for analyzing CVE-2025-55182. It demonstrates a Prototype Pollution vulnerability within the context of Next.js Server...

CLEANSTART-2026-EL48744 deepmerge through 4

Security vulnerability affects the langfuse package. deepmerge through 4...

CLEANSTART-2026-CX09609 deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects

Security vulnerability affects the langfuse package. deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects...

Exposed Dangerous Method or Function

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Exposed Dangerous Method or Function via the extend method in Blueprint.php, where untrusted Flex form override fields can exploit merge...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via its transitive dependency on deepmerge, which is affected by CVE-2026-93753. When sanitize-html merges configuration objects combining tag-specific and wildcard allowedClasses or allowedStyles entries, the...

Uncontrolled Recursion

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Uncontrolled Recursion via its transitive dependency on deepmerge, which is...

CLSA-2026-1792490574 TuxCare security update for ts-deepmerge (1 CVE)

TuxCare rebuilt ts-deepmerge to address 1 CVE. Fixed in 7.0.2-tuxcare.1...

CLSA-2026-1792476546 TuxCare security update for deepmerge-ts (1 CVE)

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 5.1.0-tuxcare.1...

CLSA-2026-1792473266 TuxCare security update for ts-deepmerge (1 CVE)

TuxCare rebuilt ts-deepmerge to address 1 CVE. Fixed in 7.0.0-tuxcare.1...

PT-2026-133825

TuxCare rebuilt ts-deepmerge to address 1 CVE. Fixed in 7.0.2-tuxcare.1...

PT-2026-133349

TuxCare rebuilt ts-deepmerge to address 1 CVE. Fixed in 7.0.0-tuxcare.1...

PT-2026-133373

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 5.1.0-tuxcare.1...

CVE-2026-93753

A flaw was found in deepmerge. This vulnerability, known as prototype poisoning, allows an attacker to inject malicious properties into an application's object prototype. This occurs in the mergeObject function due to insufficient validation of keys during object merging. By supplying specially...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Uncontrolled Recursion due to Node.js module deepmerge-ts ( CVE-2026-40345 )

Summary IBM App Connect Enterprise Discovery Connectors is vulnerable to Uncontrolled Recursion due to Node.js module deepmerge-ts. Vulnerability Details CVEID:CVE-2026-40345 DESCRIPTION: deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to...

CLSA-2026-1790870726 TuxCare security update for deepmerge-ts (1 CVE)

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 7.1.5-tuxcare.1...

PT-2026-110307

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 7.1.5-tuxcare.1...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the deepMerge helpers used for chart configuration and component i18n in I18nMixin. An attacker can write properties onto Object.prototype, making them visible on objects throughout the application, by supplying ...

Prototype Pollution

Overview @vaadin/component-base is a Vaadin component base mixins Affected versions of this package are vulnerable to Prototype Pollution via the deepMerge helpers used for chart configuration and component i18n in I18nMixin. An attacker can write properties onto Object.prototype, making them...

Prototype Pollution

Overview com.vaadin:vaadin is a Java framework for modern Java web applications. Affected versions of this package are vulnerable to Prototype Pollution via the deepMerge helpers used for chart configuration and component i18n in I18nMixin. An attacker can write properties onto Object.prototype,...