Executive brief
DeepmergeTS is a JavaScript library used to merge objects recursively. When an application passes attacker-controlled objects with circular references (self-pointers) to the deepmerge() or deepmergeInto() functions, the library crashes with a stack overflow error. This can crash Node.js services and force repeated worker restarts, disrupting service availability.
Technical details
The vulnerability is an uncontrolled recursion (CWE-674) in DeepmergeTS's object merging logic. The root cause is the absence of visited-object tracking, pair tracking, or cycle detection in the recursive merge implementation. When two objects both contain self-references through the same key path (e.g., obj.self = obj), the merge routine revisits the same object pair indefinitely, causing Node.js to throw RangeError: Maximum call stack size exceeded. The vulnerability is reachable through the public API: deepmerge(), deepmergeCustom(), deepmergeInto(), and deepmergeIntoCustom(). Attack preconditions require the ability to supply recursive object graphs to these functions; plain JSON objects cannot trigger this issue. An attacker exploiting this vulnerability forces a synchronous crash path, potentially terminating request handling or triggering repeated worker restarts. Version 8.0.0 patches the issue with cycle detection.
Affected products
- Rebecca Stevens deepmerge-ts < 8.0.0
Timeline
- 2026-08-17: disclosed
- 2026-08-16: patched: Version 8.0.0 released with cycle detection fix
- 2026-08-17: advisory: GitHub Advisory Database published