Process crash via untracked recursive record merges

Uncontrolled recursion in deepmerge-ts before 8.0.0 allows attackers to crash Node.js processes via crafted recursive object graphs. The deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs recursively merge enumerable record keys without tracking previously seen objects or object pairs, so two inputs that both self-reference at the same property path drive the merge back into the same state until Node.js throws RangeError: Maximum call stack size exceeded. Exploitation requires an application to pass attacker-controlled cyclic objects into one of those APIs; plain JSON alone does not create the required cycle, and the documented impact is process termination or worker restart loops rather than data exposure or modification.