CVE-2026-40345

deepmerge-ts mergeleft.self, right.self - mergeleft.self, right.self - mergeleft.self, right.self...

CLSA-2026-1792476546 TuxCare security update for deepmerge-ts (1 CVE)

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 5.1.0-tuxcare.1...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Uncontrolled Recursion due to Node.js module deepmerge-ts ( CVE-2026-40345 )

Summary IBM App Connect Enterprise Discovery Connectors is vulnerable to Uncontrolled Recursion due to Node.js module deepmerge-ts. Vulnerability Details CVEID:CVE-2026-40345 DESCRIPTION: deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to...

CLSA-2026-1790870726 TuxCare security update for deepmerge-ts (1 CVE)

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 7.1.5-tuxcare.1...

PT-2026-110307

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 7.1.5-tuxcare.1...

CLSA-2026-1790609747 TuxCare security update for deepmerge-ts (1 CVE)

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 7.1.6-tuxcare.1...

PT-2026-108091

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 7.1.6-tuxcare.1...

CLSA-2026-1790420043 TuxCare security update for deepmerge-ts (1 CVE)

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 4.3.0-tuxcare.1...

PT-2026-106813

TuxCare rebuilt deepmerge-ts to address 1 CVE. Fixed in 4.3.0-tuxcare.1...

CVE-2026-40345

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...

CVE-2026-40345

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...

CVE-2026-40345 deepmerge-ts: Stack exhaustion when merging recursive object graphs

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...

CVE-2026-40345 deepmerge-ts: Stack exhaustion when merging recursive object graphs

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...

EUVD-2026-63468

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...

CVE-2026-40345 deepmerge-ts: Stack exhaustion when merging recursive object graphs

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...

9drive (>=1.0.0, <=1.1.6), @30-day-challenge/prisma-schema (>=0.0.7, <=0.0.9) +7274 more potentially affected by CVE-2026-40345 via deepmerge-ts (>=1.1.7, <=7.1.6)

deepmerge-ts NPM version =1.1.7, =1.0.0, =0.0.7, =3.7.167, =1.0.102, =2.11.1, =1.0.0, =2.0.0, =1.0.0, =1.0.2, =1.0.2, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-40345 Source advisory: MEND:CVE-2026-40345...

CVE-2026-40345

deepmerge-ts

CVE-2026-40345: Uncontrolled Recursion

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...

Uncontrolled Resource Consumption

deepmerge-ts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to failure to track visited objects or object pairs during recursive merging, which allows an attacker to provide recursive object graphs that trigger infinite recursion, causing a RangeError and potentially...

CVE-2026-40345

creationtimestamp| type| source ---|---|--- 2026-08-17 14:35:03+00:00| published-proof-of-concept| https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-ggr8-5vv4-36mx 2026-08-17 18:00:03+00:00| seen| Telegram/S7eqLraqEg6Kwu3Kw8cANfzCQgkQhswVCeNeKxsnaOowjNQ 2026-08-18...