Redoc Prototype Pollution via `Module.mergeObjects` Component

Description

A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Recommendation

Update the redoc package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.4.0
• Patched version(s): 2.4.0

References

• GHSA-9rhg-254w-fh9x
• CVE-2024-57083
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Seroval affected by Denial of Service via Array serialization - CVE-2026-23957
• QuestDB UI's Web Console is Vulnerable to Cross-Site Scripting - CVE-2026-0824
• XSS in the `of` option of the `.position()` util in jquery-ui - CVE-2021-41184
• The AuthKit Remix Library renders sensitive auth data in HTML - CVE-2025-55009

Tags:

npm

redoc