CVE-2026-12644
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | ts-deepmerge | < 8.0.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-12644
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf). When user-controlled input contains these keys with non-function values, the resulting merged object becomes broken — any string context operation throws a TypeError, crashing the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5
Vulnerability Title
Voodoo Creation TypeScript Deep Merge 异常处理不当漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Voodoo Creation TypeScript Deep Merge是Voodoo Creation组织开源的一个支持 ESM 和 CommonJS 的 TypeScript 深度合并库，能够自动推断返回类型，且不会修改源对象。 Voodoo Creation TypeScript Deep Merge 8.0.0之前版本存在异常处理不当漏洞，该漏洞源于对内置Object.prototype方法（如toString、valueOf）处理不当，可能导致未捕获异常，用户控制的输入包含具有非函数值的这些键
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | ts-deepmerge | 0 ~ 8.0.0 | - |
II. Public POCs for CVE-2026-12644
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12644
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-12644 (1)
Vendor Advisories for CVE-2026-12644 (1)
Proof of Concept for CVE-2026-12644 (1)
Same Patch Batch · n/a · 2026-06-19 · 6 CVEs total
| CVE-2025-62821 | Microsoft HEIF Image Extensions 安全漏洞 | |
| CVE-2026-51843 | Tenda AC7 缓冲区溢出漏洞 | |
| CVE-2026-51846 | Tenda AC7 安全漏洞 | |
| CVE-2026-51844 | Tenda AC7 缓冲区溢出漏洞 | |
| CVE-2026-51845 | Tenda AC7 缓冲区溢出漏洞 |
IV. Related Vulnerabilities
Same product: ts-deepmerge
Same vendor: n/a
- CVE-2026-19986
Adblock for Youtube Extension Event Listener contentscript.j - CVE-2026-19965
automad Password Reset Endpoint UserController.php requestPa - CVE-2026-19955
TrailDB TOC Validation tdb.c tdb_open out-of-bounds - CVE-2026-19930
Dolibarr User Cloning card.php ldap injection - CVE-2026-19929
OpenBoxes Template Processing DocumentController.groovy buil
Same weakness: CWE-248
- CVE-2026-72813
actix-files before 0.6.10 Denial of Service via empty Range - CVE-2026-49096
Uncaught Exception in Kibana Cases Leading to Denial of Serv - CVE-2026-72660
Uncaught Exception in Kibana Leading to Denial of Service - CVE-2026-18675
Kong Mesh: control plane denial of service via a malformed d - CVE-2026-52856
Wings: Maliciously crafted packet during SFTP connection han
V. Comments for CVE-2026-12644
No comments yet