Skip to main content

Uncaught Exception

CVE-2026-12644

Medium
5.5/10

Summary

ts-deepmerge versions prior to 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in `Object.prototype` methods (such as toString, valueOf). When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken any string context operation throws a `TypeError`, crashing the application.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • LOW

CWE-248 - Uncaught Exception

An exception is thrown from a function, but it is not caught.

References

Advisory Timeline

  • Published