Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

web3-utils

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmAmendedPublished

    web3-utils Prototype Pollution vulnerability

    CVE-2024-21505 · GHSA-2g4c-8fpm-c46v

    Affected
    • npm web3-utils >= 4.0.1, < 4.2.1
    Fixed in
    4.2.1· Vendor fix available
    Issue
    Impact: The mergeDeep() function in the web3-utils package has been identified for Prototype Pollution vulnerability. An attacker has the ability to modify an object's prototype, which could result in changing the behavior of all objects that inherit from the impacted prototype by providing carefully crafted input to function. Patches: It has been fixed in web3-utils version 4.2.1 so all packages and apps depending on web3-utils =4.0.1 and <=4.2.0 should upgrade to web3-utils 4.2.1. Workarounds: None

    Recommended action: Upgrade to 4.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →