web3/web3.js

web3/web3.js

GitHubGitHub
GitHubgithub.com
web3js.orgweb3js.org
Releases234
Frequency2 weeks 1 day
Last Release
Stars19.9K
Collection of comprehensive TypeScript libraries for Interaction with the Ethereum JSON RPC API and utility functions.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2024-21505↗
7.5 HIGH—

Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge. An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting from the affected prototype by passing specially crafted input to these functions.