The deepmerge-ts library, used for deep merging JavaScript objects, has a vulnerability (CVE-2026-40345) in versions before 8.0.0. The deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs during recursive merges. When merging objects with self-references at the same property path, the merge logic repeatedly revisits the same pairs, causing a stack overflow (RangeError: Maximum call stack size exceeded) in Node.js. This can crash the affected process or cause repeated worker restarts. Plain JSON input cannot trigger this issue as it cannot create the required recursive graph. The vulnerability is addressed in deepmerge-ts version 8.0.0.

Applications using deepmerge-ts versions prior to 8.0.0 that merge attacker-controlled recursive object graphs can experience synchronous crashes due to stack exhaustion. This can lead to denial of service by crashing the Node.js process or causing repeated worker restarts. There is no indication of remote code execution or data corruption from this vulnerability.

Upgrade to deepmerge-ts version 8.0.0 or later, where this issue is fixed by tracking visited objects during recursive merges. No other mitigation is required as the fix is available and official.