Recursive Object Merge Flaw in deepmerge-ts Library from RebeccaStevens

CVE-2026-40345

What is CVE-2026-40345?

CVE-2026-40345 is a significant vulnerability identified in the deepmerge-ts library developed by RebeccaStevens, which is utilized for the deep merging of JavaScript objects in TypeScript applications. This vulnerability resides in APIs such as deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom prior to version 8.0.0. The flaw arises due to the library's failure to track visited objects during recursive merging processes, allowing the potential for infinite recursion. When an application attempts to merge objects that contain self-references at the same property path, the merge operation could lead to a stack overflow, triggering a RangeError: Maximum call stack size exceeded. If an attacker controls the input, they can exploit this flaw to cause a synchronous crash of the application or induce repeated worker restarts, severely disrupting operations.

Potential impact of CVE-2026-40345

1. Application Crashes: The primary risk associated with this vulnerability is the potential for applications to crash. Affected processes may terminate unexpectedly due to infinite recursion, leading to service downtime and interrupting business operations.

2. Denial of Service (DoS): By exploiting this vulnerability, an attacker could render services unavailable through intentional input manipulation, effectively creating a denial-of-service condition that can impact multiple users simultaneously.

3. Increased Maintenance Overhead: Organizations using the affected library may face increased maintenance and recovery efforts. The necessity to monitor and mitigate ongoing crashes due to this flaw could lead to higher operational costs and resource allocation to address the fallout from repeated application failures.

References