Technical impact
Versions of the ts-deepmerge library before 8.0.0 are vulnerable to an uncaught exception caused by improper handling of built‑in Object.prototype methods such as toString and valueOf. When user‑controlled input contains these keys with non‑function values, the resulting merged object becomes broken, and any subsequent string context operation throws a TypeError, crashing the application. This leads to a denial of service scenario that can disrupt availability and stability of the host application.
Affected Systems
The vulnerability affects the ts-deepmerge JavaScript/TypeScript library in all releases prior to version 8.0.0. Applications that use ts-deepmerge to merge objects and accept unsanitized user input are at risk.
Risk and Exploitability
The CVSS score of 6.9 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector relies on user‑controlled input supplied to ts-deepmerge; an attacker could provide malicious payloads containing disallowed properties to trigger the exception. While no known widespread exploitation has been reported, the possibility of denial of service remains, and the lack of a KEV listing suggests limited public exploitation at present.
Github GHSA