GitHub Advisoryadvisory · npm

GHSA-fg4m-w35q-vfg2 @zag-js/core prototype pollution

HIGH Published 2025-02-06 Modified 2025-03-19 Official page ↗
Aliases
CVE-2024-57079
Ecosystem
npm
Packages
@zag-js/core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1321, CWE-400
Reviewed
2025-02-06

Affected packages

• npm @zag-js/core: < 0.82.2 → fixed in 0.82.2

Description

A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Related

Alias · CVE (1)

  • CVE-2024-57079 A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service (DoS) via… vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References