CVE-2026-40345
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
deepmerge-ts prior to 8.0.0 has a vulnerability in the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs that do not track visited objects when recursively merging. When two input values contain self-references at the same property path, the merge logic repeatedly revisits the same pair until Node.js raises RangeError: Maximum call stack size exceeded, causing process crash.
Risk Assessment
An attacker could cause process crash or repeated worker restarts, potentially leading to service unavailability.
Recommendation
Update deepmerge-ts to version 8.0.0 or later. Avoid merging untrusted objects with self-references.
Related vulnerabilities
- CVE-2026-120344Critical
A vulnerability was found in the WAVLINK WN551X3-A device in the system function of /bin/ioos, within the WireGuard CLI Group Handler component. Manipulating the group_name argument leads to OS command injection, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-120322Critical
A vulnerability was identified in Termix-SSH Termix up to 2.9.2 affecting the /plugin-api/file-manager/transferToHost endpoint. Manipulation of the destPath argument leads to path traversal, and the attack can be launched remotely. The exploit is publicly available and may be used.
- CVE-2026-120283Critical
A vulnerability was identified in Linksys E8450 version 1.2.00.360516 in the strcpy function of /www/cgi-bin/portal.cgi. Manipulation of the hidden_timezone argument leads to a stack-based buffer overflow. The attack can be executed remotely, and the vendor did not respond to the disclosure.
- CVE-2026-120282Critical
A vulnerability was determined in WAVLINK WN536AX6-A version V260507 in the host_black function of /protocol.csp. Manipulation of the mac argument causes OS command injection. The exploit has been publicly disclosed and remote exploitation is possible.
- CVE-2026-120281Critical
A vulnerability was found in WAVLINK WN536AX6-A version V260507 in the OpenVPN Handler component, in the strcpy function of /protocol.csp. Manipulation of the openvpn_ip argument results in a stack-based buffer overflow. The exploit has been made public and the attack may be launched remotely.
- CVE-2026-120280Critical
A vulnerability has been found in WAVLINK WN536AX6-A version V260507 in the WireGuard component, in the wireguard_cli_group handler of /protocol.csp. Manipulation of the group_id/group_name arguments leads to OS command injection. The exploit has been disclosed publicly and the attack may be initiated remotely.
- CVE-2026-120279Critical
A flaw has been found in WAVLINK WN536AX6-A version V260507 in the openvpn_cli Handler component, in an unknown function of /protocol.csp. Manipulation of the file_id argument can lead to OS command injection. The exploit has been published and the attack can be launched remotely.
- CVE-2026-120277Critical
A vulnerability was detected in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_41a1d8 function of the /bin/ioos file, related to the WireGuard CLI group handler. Manipulation of the group_name argument leads to OS command injection. The issue can be exploited remotely and a public exploit is already available.
- CVE-2026-120276Critical
A weakness was identified in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_416760 function of the /bin/ioos file, within the web management interface component. Manipulation of the group_name argument causes OS command injection. The attack can be initiated remotely and the exploit has been made publicly available.
- CVE-2026-120240Critical
A vulnerability was found in the WAVLINK WN553X1-B device (version V260403_2.0.0) in the sub_41A748 function of /bin/ioos, part of the WireGuard CLI Group Handler. Manipulating the group_id/group_name arguments can lead to OS command injection. The attack can be performed remotely and the exploit has been publicly disclosed.
Original NVD description (English source)
deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values contain self-references at the same property path, the merge logic repeatedly revisits the same pair until Node.js raises RangeError: Maximum call stack size exceeded. Applications that merge attacker-controlled recursive object graphs can synchronously crash the affected process or cause repeated worker restarts. Plain JSON input alone cannot create the recursive graph required to trigger the issue. This issue is fixed in version 8.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS