166 matches found
ts-deepmerge: Prototype Method Override leads to DoS
Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods such as toString, valueOf. When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken —...
CVE-2026-12644
Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods such as toString, valueOf. When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken —...
CVE-2026-12644
Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods such as toString, valueOf. When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken —...
CVE-2026-12644
Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods such as toString, valueOf. When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken —...
EUVD-2026-37991
Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods such as toString, valueOf. When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken —...
CVE-2026-12644
The CVE affects ts-deepmerge before version 8.0.0. The vulnerability stems from improper handling of built-in Object.prototype methods (e.g., toString, valueOf) during merging. If user-controlled input supplies these keys with non-function values, the merged object can break and throw a TypeError...
CVE-2026-12644
Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods such as toString, valueOf. When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken —...
CVE-2026-12644
Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods such as toString, valueOf. When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken —...
CVE-2026-12644: Uncaught Exception
Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods such as toString, valueOf. When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken —...
PT-2026-50839
Name of the Vulnerable Software and Affected Versions ts-deepmerge versions prior to 8.0.0 Description An uncaught exception occurs due to improper handling of built-in Object.prototype methods, such as toString and valueOf. When user-controlled input contains these keys with non-function values,...
org.webjars.npm:dash0__sdk-web (0.18.4), org.webjars.npm:scalar__import (>=0.3.16, <=0.4.6) +3 more potentially affected by CVE-2026-12644 via org.webjars.npm:ts-deepmerge (7.0.3)
org.webjars.npm:ts-deepmerge MAVEN version 7.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:ts-deepmerge and may be impacted: - org.webjars.npm:dash0sdk-web 0.18.4 - org.webjars.npm:scalarimport =0.3.16, =0.2.107, =1.1.13, =0.1.30,...
Uncaught Exception
Overview ts-deepmerge is an a deep merge function that automatically infers the return type based on your input, without mutating the source objects. Affected versions of this package are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods such as...
WS-2019-0129
@apollo/gateway before to 0.6.2 are vulnerable to Prototype Pollution. due to use of deepMerge to merge objects...
@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function
Summary @theecryptochad/merge-guard versions prior to 1.0.1 are vulnerable to Prototype Pollution via the deepMerge function. An attacker who controls the source object can inject proto keys that mutate Object.prototype, affecting all objects in the Node.js runtime. Details The deepMerge function...
PT-2026-42530
Summary @theecryptochad/merge-guard versions prior to 1.0.1 are vulnerable to Prototype Pollution via the deepMerge function. An attacker who controls the source object can inject proto keys that mutate Object.prototype, affecting all objects in the Node.js runtime. Details The deepMerge function...
EUVD-2021-2598
Malware in sbrugna...
EUVD-2021-2604
Malware in sbrugna...
EUVD-2021-1894
Malware in sbrugna...