CVE-2026-12644 affects ts-deepmerge versions before 8.0.0. The vulnerability arises from improper handling of Object.prototype methods such as toString and valueOf during object merging. When user-controlled input contains these keys with non-function values, the merged object becomes broken. Any string context operation on this object triggers a TypeError, causing an uncaught exception and crashing the application. This is classified under CWE-248 (Uncaught Exception). No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Exploitation of this vulnerability can cause application crashes due to uncaught TypeErrors when string operations are performed on merged objects containing maliciously crafted keys. This can lead to denial of service conditions in applications using vulnerable versions of ts-deepmerge. There is no indication of privilege escalation, data disclosure, or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid merging user-controlled input that may contain Object.prototype keys such as toString or valueOf with non-function values. Implement input validation or sanitization to prevent such keys from being processed by ts-deepmerge.