CVE-2026-12644: ts-deepmerge: Prototype Method Override leads to DoS

June 19, 2026

Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf). When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken — any string context operation throws a TypeError, crashing the application.

References

gist.github.com/igorg1312/775fa00114c4d47df6ae0551779ab407
github.com/advisories/GHSA-87mf-gv2c-c62c
github.com/voodoocreation/ts-deepmerge/commit/305a05831a462fb2c353d3cbbff55a0733286f8c
nvd.nist.gov/vuln/detail/CVE-2026-12644
security.snyk.io/vuln/SNYK-JS-TSDEEPMERGE-17339141

Code Behaviors & Features

Detect and mitigate CVE-2026-12644 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →