A high-severity vulnerability affecting deepmerge-ts versions < 8.0.0, assigned a CVSS score of 8.2, exists in the DeepmergeTS library due to its inability to handle recursive object graphs. When merging values that contain self-references at the same property path, the library recurses indefinitely without tracking visited objects or detecting cycles, leading to stack exhaustion and potentially terminating request handling for affected Node.js services or triggering repeated worker restarts until malicious input is blocked. This flaw can be exploited through public API methods deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom when supplied with recursive object graphs, which is reachable by passing attacker-controlled input into these APIs. The vulnerability affects applications that pass such input to these APIs, forcing them into a synchronous crash path, and can have significant business impact on services relying on the affected library.
We recommend you to update deepmerge-ts to version 8.0.0.[/subscribe_to_unlock_form]
A high-severity vulnerability affecting deepmerge-ts versions < 8.0.0, assigned a CVSS score of 8.2, exists in the DeepmergeTS library due to its inability to handle recursive object graphs. When merging values that contain self-references at the same property path, the library recurses indefinitely without tracking visited objects or detecting cycles, leading to stack exhaustion and potentially terminating request handling for affected Node.js services or triggering repeated worker restarts until malicious input is blocked. This flaw can be exploited through public API methods deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom when supplied with recursive object graphs, which is reachable by passing attacker-controlled input into these APIs. The vulnerability affects applications that pass such input to these APIs, forcing them into a synchronous crash path, and can have significant business impact on services relying on the affected library.
We recommend you to update deepmerge-ts to version 8.0.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]