GCVE - cpe:2.3:a:n/a:ts-deepmerge:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:n/a:ts-deepmerge:*:*:*:*:*:*:*:*

part: a version: * update: *

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-12644`	vulnerable	2026-07-29 00:23:32.493837	Details available MEDIUM (5.3) Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf). When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken — any string context operation throws a TypeError, crashing the application. Published: 2026-06-19T05:00:00.666Z Updated: 2026-06-22T15:03:43.502Z Open on db.gcve.eu Reference links https://security.snyk.io/vuln/SNYK-JS-TSDEEPMERGE-17339141 https://gist.github.com/igorg1312/775fa00114c4d47df6ae0551779ab407 https://github.com/voodoocreation/ts-deepmerge/commit/305a05831a462fb2c353d3cbbff55a0733286f8c	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-25907`	vulnerable	2026-06-08 05:41:49.666307	Prototype Pollution HIGH (7.5) The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function. Published: 2022-08-09T05:00:17.639Z Updated: 2024-09-16T20:32:06.789Z Open on db.gcve.eu Reference links https://security.snyk.io/vuln/SNYK-JS-TSDEEPMERGE-2959975 https://github.com/voodoocreation/ts-deepmerge/releases/tag/2.0.2 https://github.com/voodoocreation/ts-deepmerge/commit/9be5148773343c57be9de39728d6ead18eddf10b	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.