Uncontrolled Recursion Affecting deepmerge-ts package, versions <8.0.0
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of Concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-DEEPMERGETS-18912249
- published18 Aug 2026
- disclosed17 Aug 2026
- creditJvr
Introduced: 17 Aug 2026
NewCVE-2026-40345 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade deepmerge-ts to version 8.0.0 or higher.
Overview
deepmerge-ts is a Deeply merge 2 or more objects respecting type information.
Affected versions of this package are vulnerable to Uncontrolled Recursion via the deepmerge and deepmergeInto functions. An attacker can cause a process crash or denial of service by supplying crafted recursive object graphs that trigger unbounded recursion and stack exhaustion.