The deepmerge-ts library contains a critical uncontrolled recursion vulnerability that can be leveraged by attackers to crash applications via resource exhaustion.

This vulnerability is an uncontrolled recursion (CWE-674) issue that occurs during the merging of specifically crafted JavaScript objects, allowing an unauthenticated attacker to trigger a stack overflow or resource exhaustion.

An attacker can cause application downtime by sending requests that trigger this recursive logic, resulting in a denial-of-service condition. With a CVSS score of 8.2, this vulnerability represents a significant threat to the availability of any service relying on this library to process incoming user-supplied JSON or object data.

Immediate Action: Update the deepmerge-ts package to version 8.0.0 or later to include the fix for recursive object processing.

Proactive Monitoring: Monitor application logs for unexpected performance degradation or frequent process crashes occurring during object merging operations.

Compensating Controls: Implement input validation to limit the depth of incoming JSON objects before they are processed by the library, as a temporary protective measure.

Public Exploit Available: Yes (a public proof-of-concept exists on GitHub).

Security teams should audit their dependency trees and update deepmerge-ts to version 8.0.0 immediately. Because a proof-of-concept is publicly available, the risk of automated or targeted denial-of-service attacks is elevated, making rapid remediation essential for maintaining service availability.