{"action":"Upgrade deepmerge-ts to 8.0.0 or later.","affected":[{"fixed":"8.0.0","introduced":"0"}],"component":"deepmerge-ts","cve_ids":["CVE-2026-40345"],"ecosystem":"npm","epss":0.00524,"exploited":false,"fixed_versions":["8.0.0"],"ghsa_id":"GHSA-ggr8-5vv4-36mx","id":"tcs_01M5KFRP8WP58819TMYJKZC68T","modified_at":"2026-09-10T03:51:14.089937520Z","published_at":"2026-08-17T13:32:13Z","references":["https://osv.dev/vulnerability/GHSA-ggr8-5vv4-36mx","https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-ggr8-5vv4-36mx","https://github.com/RebeccaStevens/deepmerge-ts","https://github.com/RebeccaStevens/deepmerge-ts/releases/tag/v8.0.0"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-ggr8-5vv4-36mx","url":"https://osv.dev/vulnerability/GHSA-ggr8-5vv4-36mx"}],"summary":"DeepmergeTS has stack exhaustion when merging recursive object graphs"}