CVE-2026-40345

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values contain self-references at the same property path, the merge logic repeatedly revisits the same pair until Node.js raises RangeError: Maximum call stack size exceeded. Applications that merge attacker-controlled recursive object graphs can synchronously crash the affected process or cause repeated worker restarts. Plain JSON input alone cannot create the recursive graph required to trigger the issue. This issue is fixed in version 8.0.0.

• CWE-674

• https://github.com/RebeccaStevens/deepmerge-ts/commit/398492757b3f22a0d7d89b09ce1ae9cd32806c9a
• https://github.com/RebeccaStevens/deepmerge-ts/pull/707
• https://github.com/RebeccaStevens/deepmerge-ts/releases/tag/v8.0.0
• https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-ggr8-5vv4-36mx
• https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-ggr8-5vv4-36mx

Published

Aug 20, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40339libgphoto2 is a camera access and control library. Versions …5.2
• CVE-2026-40340libgphoto2 is a camera access and control library. Versions …6.1
• CVE-2026-40341libgphoto2 is a camera access and control library. In versio…3.5
• CVE-2026-40342Firebird is an open-source relational database management sy…9.9
• CVE-2026-40343free5GC UDR is the user data repository (UDR) for free5GC, a…5.8
• CVE-2026-40344MinIO is a high-performance object storage system. Starting …8.2
• CVE-2026-40346NocoBase is an AI-powered no-code/low-code platform for buil…6.5
• CVE-2026-40347Python-Multipart is a streaming multipart parser for Python.…5.3
• CVE-2026-40348Movary is a self hosted web app to track and rate a user's w…7.7
• CVE-2026-40349Movary is a self hosted web app to track and rate a user's w…8.8
• CVE-2026-4035A vulnerability in mlflow/mlflow versions prior to 3.11.0 al…7.7
• CVE-2026-40350Movary is a self hosted web app to track and rate a user's w…8.8