Executive brief
ts-deepmerge is a software library used by developers to combine multiple data objects into one. A flaw in how it handles specific data keys allows an attacker to provide malicious input that "breaks" the resulting object. When the application later tries to use this object (such as for logging or displaying text), it will trigger a fatal error and crash, leading to a denial-of-service.
Technical details
The merge() function in ts-deepmerge before version 8.0.0 uses an incomplete blocklist to prevent prototype-related overrides. While it blocks '__proto__', 'constructor', and 'prototype', it fails to block other built-in Object.prototype methods such as 'toString' and 'valueOf'. An attacker can provide a JSON object where these keys are mapped to non-function values (e.g., a string). When merged, the resulting object's native methods are shadowed; subsequent operations that implicitly call these methods (like string concatenation or template literals) throw a TypeError. This results in an uncaught exception that crashes the Node.js process. The issue is fixed in version 8.0.0 by extending the blocklist to include all standard Object.prototype methods.
Affected products
- voodoocreation ts-deepmerge < 8.0.0
Timeline
- 2026-05-21: disclosed: Vulnerability reported by Igor Garofano
- 2026-06-18: advisory: Snyk published advisory SNYK-JS-TSDEEPMERGE-17339141
- 2026-06-19: disclosed: CVE-2026-12644 published