Uncaught Exception Vulnerability in ts-deepmerge Package by Voodoo Creation

CVE-2026-12644

What is CVE-2026-12644?

The ts-deepmerge package prior to version 8.0.0 is vulnerable to an uncaught exception due to its inadequate handling of built-in Object.prototype methods, such as toString and valueOf. This vulnerability allows an attacker to exploit the application by providing user-controlled input that contains these keys with non-function values. As a result, the merged object becomes unstable, and any operation requiring a string context will trigger a TypeError, ultimately crashing the application.

References