---
id: CVE-2026-12644
title: 'ts-deepmerge: Prototype Method Override leads to DoS'
summary: 'ts-deepmerge: Prototype Method Override leads to DoS'
severity: medium
cvss: 5.3
cwe:
  - CWE-248
vendor: ts-deepmerge
product: ts-deepmerge
affected:
  - ts-deepmerge < 8.0.0
patched:
  - ts-deepmerge 8.0.0
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-87mf-gv2c-c62c'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12644'
  - url: >-
      https://github.com/voodoocreation/ts-deepmerge/commit/305a05831a462fb2c353d3cbbff55a0733286f8c
  - url: 'https://gist.github.com/igorg1312/775fa00114c4d47df6ae0551779ab407'
  - url: 'https://security.snyk.io/vuln/SNYK-JS-TSDEEPMERGE-17339141'
  - url: 'https://github.com/advisories/GHSA-87mf-gv2c-c62c'
tags:
  - ghsa
  - npm
ingestedAt: '2026-06-22T15:59:08.209Z'
epss: 0.00507
epssPercentile: 0.40702
ecosystem: npm
---

## Overview

Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf). When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken — any string context operation throws a TypeError, crashing the application.

## Affected packages

- `ts-deepmerge < 8.0.0`

## Remediation

Upgrade to a patched release:

- `ts-deepmerge 8.0.0`