ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution

CRITICAL 9.8CVE-2022-25907 · GHSA-7qqq-gh2f-wq76 · Published 09/08/2022 · updated 17/06/2026

In short

CVE-2022-25907 is a CRITICAL (CVSS 9.8) vulnerability affecting typescript deep merge (typescript deep merge project), ts-deepmerge.
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.8% of all vulnerabilities.
Fix: update to 2.0.2 or later.

Package	Affected versions	Patched versions
typescript deep merge typescript_deep_merge_project	`< 2.0.2`	`2.0.2`
ts-deepmerge npm	`< 2.0.2`	`2.0.2`

The package ts-deepmerge before version 2.0.2 is vulnerable to Prototype Pollution due to missing sanitization of the merge function.

NVD description

The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.