Deepmerge-Ts (< 8.0.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/deepmerge-ts--8.0.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 17 Aug 2026 18:47:21 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStack Exhaustion Vulnerability in deepmerge-tshttps://feed.craftedsignal.io/briefs/2026-08-deepmerge-ts-stack-exhaustion/Mon, 17 Aug 2026 18:47:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-deepmerge-ts-stack-exhaustion/The deepmerge-ts library contains a stack exhaustion vulnerability, CVE-2026-40345, that allows attackers to trigger a process crash by providing crafted, self-referencing recursive object graphs to merge functions.The deepmerge-ts library (versions prior to 8.0.0) is susceptible to a denial-of-service attack due to a flaw in its recursive object merging logic. The library recursively traverses object trees to perform merges but lacks cycle detection or tracking for visited object pairs. An attacker who can influence the input objects passed to functions such as deepmerge(), deepmergeInto(), or their custom variations can provide a crafted object graph containing self-references. When the library attempts to merge these structures, it enters an infinite recursion, eventually causing the Node.js runtime to throw a 'RangeError: Maximum call stack size exceeded'. This vulnerability impacts applications that allow users to submit complex or serialized objects for server-side processing, potentially leading to repeated service crashes and availability loss.

Impact

Applications that process attacker-supplied object structures using vulnerable versions of deepmerge-ts are at risk of a synchronous service crash. In Node.js-based environments, this can lead to unhandled exceptions that terminate the process. In clustered or managed environments, this may trigger frequent worker restarts, effectively creating a persistent denial-of-service state for the targeted application endpoint.

Recommendation

  • Upgrade the deepmerge-ts dependency to version 8.0.0 or later to include the required cycle detection logic.
  • Audit all application endpoints that accept user-provided JSON or object structures for processing to ensure input is validated before being passed to deepmerge-ts.
  • Monitor logs for repeated 'RangeError: Maximum call stack size exceeded' exceptions linked to application processes to identify potential exploitation attempts.
]]>mediumadvisory