{"id":"CVE-2026-12644","title":"ts-deepmerge: Prototype Method Override leads to DoS","summary":"ts-deepmerge: Prototype Method Override leads to DoS","severity":"medium","cvss":5.3,"cwe":["CWE-248"],"vendor":"ts-deepmerge","product":"ts-deepmerge","affected":["ts-deepmerge < 8.0.0"],"patched":["ts-deepmerge 8.0.0"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-87mf-gv2c-c62c","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12644"},{"url":"https://github.com/voodoocreation/ts-deepmerge/commit/305a05831a462fb2c353d3cbbff55a0733286f8c"},{"url":"https://gist.github.com/igorg1312/775fa00114c4d47df6ae0551779ab407"},{"url":"https://security.snyk.io/vuln/SNYK-JS-TSDEEPMERGE-17339141"},{"url":"https://github.com/advisories/GHSA-87mf-gv2c-c62c"}],"tags":["ghsa","npm"],"ingestedAt":"2026-06-22T15:59:08.209Z","epss":0.00507,"epssPercentile":0.42266,"ecosystem":"npm","slug":"CVE-2026-12644","body":"## Overview\n\nVersions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf). When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken — any string context operation throws a TypeError, crashing the application.\n\n## Affected packages\n\n- `ts-deepmerge < 8.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ts-deepmerge 8.0.0`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}