GHSA-9rhg-254w-fh9x

Redoc Prototype Pollution via `Module.mergeObjects` Component

At a glance

Published: 2025-03-28 21:30 UTC
Updated: 2025-03-31 16:24 UTC
CVE: CVE-2024-57083
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

Description

A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Affected packages

Package	Versions
npm · redoc	introduced 0, fixed 2.4.0

References

https://nvd.nist.gov/vuln/detail/CVE-2024-57083 ADVISORY
https://github.com/Redocly/redoc/issues/2499 WEB
https://github.com/Redocly/redoc/pull/2638 WEB
https://github.com/Redocly/redoc PACKAGE

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database