EUVD-2026-63468
GHSA-ggr8-5vv4-36mx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the meaningful precondition that circular JS object graphs must reach the API; no confidentiality or integrity impact applies.
Primary rating from Vendor (https://github.com/RebeccaStevens/deepmerge-ts).
CVSS VectorVendor: https://github.com/RebeccaStevens/deepmerge-ts
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
Summary
deepmerge() and deepmergeInto() can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws RangeError: Maximum call stack size exceeded.
Details
Record merging is implemented recursively. For each enumerable key, the library collects the values from every input object and immediately calls the same merge routine on that property.
There is no visited-object tracking, pair tracking, or cycle detection in that recursion. As a result, if two merged records both point back to themselves through the same key path, the merge logic keeps revisiting the same object pair forever.
This is reachable through the real public API:
deepmerge(...)deepmergeCustom(...)(...)deepmergeInto(target, ...)deepmergeIntoCustom(...)(target, ...)
The issue only occurs when recursive object graphs are supplied. Plain JSON alone does not create this condition.
PoC
import { deepmerge, deepmergeInto } from "deepmerge-ts";
const left = {};
left.self = left;
const right = {};
right.self = right;
try {
deepmerge(left, right);
} catch (error) {
console.log(error.name, error.message);
// Expected: the merge should reject or safely handle recursive input without exhausting the stack.
// Vulnerable behavior: RangeError Maximum call stack size exceeded
}
const target = {};
target.self = target;
const source = {};
source.self = source;
try {
deepmergeInto(target, source);
} catch (error) {
console.log(error.name, error.message);
// Expected: the merge should reject or safely handle recursive input without exhausting the stack.
// Vulnerable behavior: RangeError Maximum call stack size exceeded
}Impact
Applications that pass attacker-controlled recursive object graphs into these APIs can be forced into a synchronous crash path. In Node.js services, that can terminate request handling for the affected process or trigger repeated worker restarts until the malicious input is blocked.
Articles & Coverage 1
AnalysisAI
Stack exhaustion denial-of-service in deepmerge-ts crashes Node.js processes when attacker-controlled recursive object graphs are passed to deepmerge(), deepmergeInto(), deepmergeCustom()(), or deepmergeIntoCustom()(). All versions prior to 8.0.0 lack cycle detection in the recursive record-merge routine, allowing two self-referencing objects sharing a key path to drive the process into infinite recursion until the Node.js runtime throws RangeError: Maximum call stack size exceeded. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that both of the objects passed to a deepmerge-ts merge function contain circular (self-referential) references at the same property path - for example, `obj.self = obj` on both the left and right inputs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.2 and reflects network reachability with zero authentication and high availability impact, moderated by AT:P - a specific attack precondition requiring that circular object graphs actually reach the deepmerge-ts API call. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a request to a Node.js API endpoint whose handler reconstructs user-supplied data into a JavaScript object graph - for instance, a form-body parser or a GraphQL mutation resolver that builds nested objects with back-references. The handler then calls `deepmerge(userObject, defaultConfig)` where both objects contain a shared self-referential key path. … |
| Remediation | Upgrade deepmerge-ts to version 8.0.0 or later, which introduces circular-reference support configurable via a new `maxDepth` option and a `mergeCircularReferences` merge-function option; see the security advisory at https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-ggr8-5vv4-36mx and the release notes at https://github.com/RebeccaStevens/deepmerge-ts/releases/tag/v8.0.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications and dependencies using deepmerge-ts and verify which versions are deployed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today