HIGH GitHub
CVE-2026-40345
DeepmergeTS has stack exhaustion when merging recursive object graphs
### Summary
`deepmerge()` and `deepmergeInto()` can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws `RangeError: Maximum call stack size exceeded`.
### Details
Record merging is implemented recursively. For each enumerable key, the library collects the values from every input object and immediately calls the same merge routine on that property.
There is no visited-object tracki
Affected Products
- npm/deepmerge-ts < 8.0.0
References
- https://github.com/advisories/GHSA-ggr8-5vv4-36mx
- https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-ggr8-5vv4-36mx
- https://github.com/RebeccaStevens/deepmerge-ts/releases/tag/v8.0.0
- https://github.com/advisories/GHSA-ggr8-5vv4-36mx
This high severity vulnerability was published on 2026-08-17 via GitHub. Affected: npm/deepmerge-ts < 8.0.0.
vulnfeed aggregates 11698 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.