CVE-2026-12644Medium· 5.3▾ Sunlitts-deepmerge: Prototype Method Override leads to DoS
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.5%
Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf). When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken — any string context operation throws a TypeError, crashing the application.
ts-deepmerge < 8.0.0Upgrade to a patched release:
ts-deepmerge 8.0.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44001High· 8.6vm2 is an open source vm/sandbox for Node.js
CVE-2026-113872High· 7.5multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
CVE-2026-111181High· 7.5body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
CVE-2026-109869High· 7.5undici is an HTTP client library for Node.js
CVE-2026-109855High· 7.5undici is an HTTP client library for Node.js
CVE-2026-110816Medium· 5.3### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ "toStri…