---
id: CVE-2026-40345
title: >-
  deepmerge-ts is a typescript library providing functionality to deep merging
  of javascript objects
summary: >-
  deepmerge-ts is a typescript library providing functionality to deep merging
  of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom,
  deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or
  object pairs …
severity: high
cwe:
  - CWE-674
vendor: deepmerge-ts
product: deepmerge-ts
affected:
  - deepmerge-ts < 8.0.0
patched:
  - deepmerge-ts 8.0.0
published: '2026-08-20'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-40345'
references:
  - url: >-
      https://github.com/RebeccaStevens/deepmerge-ts/commit/398492757b3f22a0d7d89b09ce1ae9cd32806c9a
    label: security-advisories@github.com
  - url: 'https://github.com/RebeccaStevens/deepmerge-ts/pull/707'
    label: security-advisories@github.com
  - url: 'https://github.com/RebeccaStevens/deepmerge-ts/releases/tag/v8.0.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-ggr8-5vv4-36mx
    label: security-advisories@github.com
  - url: >-
      https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-ggr8-5vv4-36mx
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-ggr8-5vv4-36mx'
tags:
  - nvd
  - exploit-available
  - ghsa
  - npm
epss: 0.00467
epssPercentile: 0.39674
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/Jvr2022/CVE-2026-40345'
  checkedAt: '2026-09-24T07:53:03.097Z'
exploitAvailable: true
aliases:
  - GHSA-ggr8-5vv4-36mx
ecosystem: npm
ingestedAt: '2026-08-17T13:54:47.961Z'
---

## Overview

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values contain self-references at the same property path, the merge logic repeatedly revisits the same pair until Node.js raises RangeError: Maximum call stack size exceeded. Applications that merge attacker-controlled recursive object graphs can synchronously crash the affected process or cause repeated worker restarts. Plain JSON input alone cannot create the recursive graph required to trigger the issue. This issue is fixed in version 8.0.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-40345)

Affected packages:

- `deepmerge-ts < 8.0.0`

Patched in:

- `deepmerge-ts 8.0.0`

Source: https://github.com/advisories/GHSA-ggr8-5vv4-36mx