2vulnerabilities
- Critical1 (50.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (50.0%)
- Low0 (0.0%)
ts-deepmerge
Ecosystem: npm
Downloads:
- 1CriticalAffects 1 version
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting ts-deepmerge, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-87mf-gv2c-c62c | Moderate | ts-deepmerge: Prototype Method Override leads to DoSVersions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf). When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken — any string context operation throws a TypeError, crashing the application. |
| GitHub (opens in a new tab) | |
| GHSA-7qqq-gh2f-wq76 | Critical | ts-deepmerge before 2.0.2 vulnerable to Prototype PollutionThe package ts-deepmerge before version 2.0.2 is vulnerable to Prototype Pollution due to missing sanitization of the `merge` function. |
| GitHub (opens in a new tab) |
- GHSA-87mf-gv2c-c62cModeratets-deepmerge: Prototype Method Override leads to DoS
< 8.0.0
Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf). When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken — any string context operation throws a TypeError, crashing the application.
CVE: CVE-2026-12644
- GHSA-7qqq-gh2f-wq76Criticalts-deepmerge before 2.0.2 vulnerable to Prototype Pollution
< 2.0.2
The package ts-deepmerge before version 2.0.2 is vulnerable to Prototype Pollution due to missing sanitization of the `merge` function.
CVE: CVE-2022-25907