CVE-2026-40345 RebeccaStevens CVE debrief

Who should care

Developers and administrators using the deepmerge-ts library in applications that merge recursive object graphs should be aware of this vulnerability, especially those with potential attacker-controlled input. This includes teams responsible for vulnerability management, security, and platform operations. They should assess their usage of deepmerge-ts library versions prior to 8.0.0 and plan for updates or mitigations as necessary. Additionally, security teams should monitor for potential crashes or worker restarts due to recursive object graph merges and implement compensating controls to limit the impact of potential crashes. Affected teams should also review the official advisory and CVE record to validate affected scope, severity, and vendor guidance, and track exceptions and retest remediated assets after evidence is documented. Those responsible for asset inventory and change management should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. They should also check relevant monitoring, detection, and logs for exposed assets that need extra review. Those managing change windows should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Those focused on compensating controls should review compensating controls for exposed systems while remediation is scheduled and verified. Those tracking source references should review source references for additional context and details. Those managing source tracking should track source references for additional context and details. Those managing rollback and change windows should plan for potential rollback if needed. Those managing security operations should monitor for potential security incidents related to this vulnerability. Those managing asset inventory should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Those managing vulnerability management should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. Those managing platform operations should assess their usage of deepmerge-ts library and

Technical summary

The deepmerge-ts library prior to version 8.0.0 has a vulnerability where the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs. This can lead to a RangeError: Maximum call stack size exceeded when merging recursive object graphs. Plain JSON input alone cannot create the required recursive graph. The issue is fixed in version 8.0.0.

Defensive priority

CVE-2026-40345 is rated HIGH with a CVSS score of 8.2. Applications merging attacker-controlled recursive object graphs can synchronously crash or cause repeated worker restarts.

Recommended defensive actions

• Inventory and assess usage of deepmerge-ts library versions prior to 8.0.0
• Apply version 8.0.0 or later of deepmerge-ts library
• Monitor for potential crashes or worker restarts due to recursive object graph merges
• Implement compensating controls to limit impact of potential crashes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The deepmerge-ts library prior to version 8.0.0 has a vulnerability where the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs. This can lead to a RangeError: Maximum call stack size exceeded when merging recursive object graphs. Plain JSON input alone cannot create the required recursive graph.

Official resources