@zag-js/core prototype pollution

Description

A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Recommendation

Update the @zag-js/core package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.82.2
• Patched version(s): 0.82.2

References

• GHSA-fg4m-w35q-vfg2
• CVE-2024-57079
• CWE-1321
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• @tanstack/form-core prototype pollution - CVE-2024-57068
• @intlify/shared Prototype Pollution vulnerability - @intlify/vue-i18n-core - CVE-2024-52810
• vue-i18n has cross-site scripting vulnerability with prototype pollution - @intlify/core-base - CVE-2024-52809
• vue-i18n has cross-site scripting vulnerability with prototype pollution - @intlify/vue-i18n-core - CVE-2024-52809

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@zag-js/core