Skip to content
OpenAdvisories
High · 7.5 CVE-2024-57083 EUVD-2024-54329GHSA-9rhg-254w-fh9x

Redoc Prototype Pollution via `Module.mergeObjects` Component

Published Mar 28, 2025 · Updated Apr 1, 2025 · Assigned by mitre

Description

A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Affected packages

EcosystemPackageAffectedFixedRecord
npm redoc < 2.4.0 2.4.0 GHSA-9rhg-254w-fh9x

References