CVE-2026-12644: ts-deepmerge Denial of Service via Prototype Method Injection

Technical summary

The vulnerability stems from improper handling of Object.prototype reserved method names during the deep merge operation. When ts-deepmerge encounters user-controlled input with keys matching built-in object methods (toString, valueOf, etc.) assigned non-function values, these properties overwrite the prototype's method implementations on the merged object. The CVSS 3.1 vector (5.3 MEDIUM, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects a network-accessible denial-of-service condition with no authentication required, but no confidentiality or integrity impact. The weakness is classified under CWE-248 (Uncaught Exception).

Business impact

Applications using ts-deepmerge as a dependency face availability risk. Any service that merges untrusted JSON (from API requests, uploaded files, webhooks, or third-party integrations) with this library version becomes susceptible to crash attacks. For data processing pipelines, configuration management systems, or multi-tenant SaaS platforms that merge user-provided settings, a single malicious payload can trigger application downtime. The impact is limited to denial of service, but recovery requires restarting the affected process.

Affected systems

The vulnerability affects all versions of the npm package ts-deepmerge before version 8.0.0. Any project directly importing ts-deepmerge or indirectly relying on it as a transitive dependency could be affected. JavaScript/Node.js applications across all operating systems are in scope. Organizations should audit their dependency trees using tools like `npm ls ts-deepmerge` or equivalent package audits to identify affected installations.

Exploitability

Exploitation requires no authentication, no special privileges, and no user interaction. An attacker simply needs to supply a crafted object with a prototype method name (e.g., `{"toString": 123}`) to an API endpoint or configuration interface that uses ts-deepmerge to merge the input. The low complexity and network accessibility make this straightforward to weaponize at scale. However, the attacker must have a pathway to provide input to the merge operation—not all applications expose this.

Remediation

Upgrade ts-deepmerge to version 8.0.0 or later. This patch version resolves the improper handling of Object.prototype methods. Organizations should verify the fix is available through the official npm registry and test the upgraded package in a development environment before rolling out to production. For applications unable to upgrade immediately, consider input validation to reject objects with keys matching reserved method names, though this is a temporary mitigation and not a substitute for patching.

Patch guidance

Update the dependency in package.json to ts-deepmerge@^8.0.0 (or specify 8.0.0 or any newer version). Run `npm install` or equivalent to pull the patched version. Ensure your CI/CD pipeline validates that the installed version meets the minimum requirement. Test any code paths that perform deep merges with untrusted or external data. If using npm, run `npm audit` post-update to confirm the CVE is no longer flagged.

Detection guidance

Monitor runtime errors for TypeErrors related to toString or valueOf operations in merged objects. Application logs showing crashes during JSON merge or configuration loading are indicators of exploitation attempts. Additionally, use dependency scanning tools (npm audit, OWASP Dependency-Check, Snyk) to identify ts-deepmerge versions below 8.0.0 in your codebase. Network-level detection is difficult since the attack payload is legitimate-looking JSON; focus on application behavior and supply-chain visibility.

Why prioritize this

Although classified as MEDIUM severity, ts-deepmerge is a widely-used utility in the Node.js ecosystem. The attack surface depends on how and where your applications perform deep merges. If your services accept untrusted JSON for configuration, user profile merging, or aggregated data processing, this should be prioritized for immediate patching. If ts-deepmerge usage is limited to internal, trusted data only, the risk is lower. Assess your exposure path and prioritize accordingly.

Risk score, explained

CVSS 5.3 (MEDIUM) reflects a denial-of-service vulnerability with network access, low complexity, no authentication, and limited to availability impact. The score does not account for the ubiquity of ts-deepmerge in the ecosystem or organizational dependency on affected applications. Internal risk scoring should consider the criticality of services using the library and the likelihood of untrusted input reaching the merge function.

Frequently asked questions