The ts-deepmerge package prior to version 8.0.0 improperly handles built-in Object.prototype methods such as toString and valueOf during object merging. When user-controlled input contains these keys with non-function values, the merged object becomes corrupted. Any subsequent string context operation on this object triggers a TypeError, resulting in an uncaught exception that crashes the application. This vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. No official patch or remediation guidance is currently documented.

Exploitation of this vulnerability causes the application to crash due to uncaught TypeErrors when string operations are performed on the corrupted merged object. This can lead to denial of service conditions but does not indicate privilege escalation or data disclosure based on the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid merging user-controlled input that includes Object.prototype keys with non-function values or implement input validation to prevent such keys from being processed.