VYPR
← All advisories
High severity7.5NVD Advisory· Published Mar 25, 2024· Updated Apr 15, 2026

CVE-2024-21505

CVE-2024-21505

Description

Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge. An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting from the affected prototype by passing specially crafted input to these functions.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
web3-utilsnpm
>= 4.0.1, < 4.2.14.2.1

Patches

2
8ed041c6635d

Research (#6841)

https://github.com/web3/web3.jsOleksii KosynskyiMar 5, 2024via ghsa
commit
2 files changed · +2 −2
  • packages/web3-utils/src/index.ts+1 −1 modified
    @@ -33,4 +33,4 @@ export * from './web3_eip1193_provider.js';
 export * from './socket_provider.js';
 export * from './uint8array.js';
 // for backwards compatibility with v1
-export {AbiItem} from 'web3-types';
\ No newline at end of file
+export { AbiItem } from 'web3-types';
  • packages/web3-utils/src/objects.ts+1 −1 modified
    @@ -36,7 +36,7 @@ export const mergeDeep = (
 	destination: Record<string, unknown>,
 	...sources: Record<string, unknown>[]
 ): Record<string, unknown> => {
-	const result = destination; // clone deep here
+	const result = { ...destination }; // clone deep here
 	if (!isIterable(result)) {
 		return result;
 	}
a6c6dec9fef0
https://github.com/web3/web3.jsvia osv

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.