deepmerge-ts provides deep merging of JavaScript objects. The library lacks cycle detection before version 8.0, so recursive self‑referencing objects at the same property path cause the algorithm to repeatedly merge the same pair of objects, leading to a stack overflow and a RangeError. When an attacker supplies such a structure, the application that calls deepmerge will synchronously crash or trigger worker restarts, resulting in denial of service. The weakness is classified as CWE‑674, Uncontrolled Recursion.

The vulnerability affects any Node.js application that imports the deepmerge-ts library prior to version 8.0.0. This includes all releases ranging from the initial commit through the 7.x series. Users of the library via npm or other package managers should verify the installed version and ensure they are not using an old release.

The CVSS base score is 8.2, indicating high severity, while the EPSS score is unavailable but the lack of a KEV listing suggests it has not yet been widely exploited. The attack requires the application to receive and merge a crafted object graph controlled by an adversary. If the library is invoked in a publicly exposed endpoint, the attack can be launched remotely; otherwise it would be limited to the local environment. Exploitation does not provide code execution or privilege escalation, but it can disrupt service availability and destabilize Node.js worker processes.