EUVD-2026-37991
GHSA-87mf-gv2c-c62c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no authentication required (PR:N); impact is limited to a process crash with no data exposure or integrity change, so C:N/I:N/A:L.
Primary rating from Vendor (snyk).
CVSS VectorVendor: snyk
Lifecycle Timeline
4Blast Radius
ecosystem impact- 191 npm packages depend on ts-deepmerge (50 direct, 145 indirect)
Ecosystem-wide dependent count for version 8.0.0.
DescriptionCVE.org
Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf). When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken - any string context operation throws a TypeError, crashing the application.
AnalysisAI
Uncaught Exception in ts-deepmerge before 8.0.0 allows unauthenticated remote attackers to crash Node.js applications by supplying JSON payloads that contain Object.prototype method names (e.g., toString, valueOf) mapped to non-function values, causing any subsequent string-context operation on the merged object to throw a TypeError. The vulnerability is distinct from classic prototype pollution - it does not escalate privileges or leak data, but reliably corrupts the merged object's callable methods, making DoS trivially achievable against any network-exposed merge endpoint that accepts untrusted input. A public proof-of-concept exists (GitHub Gist, Snyk SNYK-JS-TSDEEPMERGE-17339141), and the CVSS 4.0 E:P supplemental metric confirms exploit code is available; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
ts-deepmerge is a TypeScript/JavaScript npm library for recursively merging plain objects, widely used in Node.js applications for configuration merging and data aggregation. The root cause class is CWE-248 (Uncaught Exception): during key iteration in the merge() function, the library previously blocked only three dangerous keys - __proto__, constructor, and prototype - the classic prototype pollution trifecta. It failed to block Object.prototype method keys such as toString, valueOf, hasOwnProperty, isPrototypeOf, propertyIsEnumerable, and toLocaleString. When a caller merges a user-controlled object containing, for example, {"toString": 42}, the merged output object has its toString property overwritten with the integer 42. Any subsequent implicit string coercion - template literals, string concatenation, console.log, JSON serialization paths that call toString - invokes the property as a function, finds a non-callable primitive, and throws a TypeError. Because ts-deepmerge does not catch this, the exception propagates unhandled and crashes the process. The fix commit (305a058 on voodoocreation/ts-deepmerge) introduces a UNSAFE_KEYS Set containing all nine dangerous key names and gates every key assignment through a membership check. The affected CPE is cpe:2.3:a:n/a:ts-deepmerge:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade ts-deepmerge to version 8.0.0 or later, which introduces the UNSAFE_KEYS blocklist covering __proto__, constructor, prototype, toString, valueOf, hasOwnProperty, isPrototypeOf, propertyIsEnumerable, and toLocaleString. The upstream fix is available at https://github.com/voodoocreation/ts-deepmerge/commit/305a05831a462fb2c353d3cbbff55a0733286f8c and the Snyk advisory is at https://security.snyk.io/vuln/SNYK-JS-TSDEEPMERGE-17339141. If an immediate upgrade is not feasible, apply input sanitization before calling merge(): use a JSON schema validator (e.g., ajv with a strict allowlist of permitted keys) to reject any payload containing the nine unsafe key names - this adds a dependency but provides reliable defense. A simpler compensating control is to filter user-supplied objects with a recursive function that deletes keys matching the unsafe set before passing data to merge(); the trade-off is that this silently drops fields, which may introduce data-loss bugs if not handled explicitly. Wrapping merge() calls in try/catch prevents process crashes but does not fix the underlying object corruption and must not be treated as a security remediation.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-248 – Uncaught Exception
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today