@arb-protocol/core (>=2.0.0-alpha.1, <=2.0.0-alpha.5), @arb-protocol/jupiter-adapter (>=2.0.0-alpha.5, <=2.0.0-alpha.6) +80 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.31.0)

@solana/web3.js NPM version 1.31.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @arb-protocol/core =2.0.0-alpha.1, =2.0.0-alpha.5, =2.0.0-alpha.1, =2.20.0-rc.38, =1.0.1-rc.0, =0.0.1, =0.0.1, =1.0.0, =0.2.0,...

@leapwallet/elements (1.1.0), @neoswap/solana-collection-swap (0.1.6-Beta1) +3 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.91.1, <=1.91.2)

@solana/web3.js NPM version =1.91.1, =0.0.18, =4.1.2, =2.2.5, =6.1.2 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@iwcapital/cli (>=0.3.0, <=0.3.2), @iwcapital/core (>=0.3.0, <=0.3.3) +19 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.77.2, <=1.77.3)

@solana/web3.js NPM version =1.77.2, =0.3.0, =0.3.0, =0.2.0, =0.2.20, =0.7.0-next.0, =0.0.155, =0.8.24, =0.8.19, =0.8.22, =0.8.20, =0.8.33, =0.8.23, =0.8.20, =0.8.53, =0.8.65 and more Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@civic/multichain-connect-react-solana-wallet-adapter (>=0.0.0-alpha.1, <=0.0.3-beta.11), @debridge-finance/dln-client (>=5.1.0, <=8.2.2) +6 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.76.0)

@solana/web3.js NPM version 1.76.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @civic/multichain-connect-react-solana-wallet-adapter =0.0.0-alpha.1, =5.1.0, =2.11.0-alpha.0, =1.0.0, =0.1.1-alpha.8,...

2.typescript-init (1.0.0), @bloxroute/solana-trader-client-ts (>=1.5.1, <=2.2.12) +72 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.73.0, <=1.73.3)

@solana/web3.js NPM version =1.73.0, =1.5.1, =0.2.11, =5.1.0, =2.11.0-alpha.0, =1.0.0, =1.1.0, =2.0.0, =1.12.51, =2.60.0-beta.6.0.0.1, =0.2.0, =0.1.0, =0.10.385 and more Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@nikaru-dev/provider-all (>=0.25.1-next.3, <=0.26.0), @nikaru-dev/provider-walletconnect-2 (>=0.18.1-next.2, <=0.19.1-next.0) +11 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.67.0, <=1.67.2)

@solana/web3.js NPM version =1.67.0, =0.25.1-next.3, =0.18.1-next.2, =0.20.1-next.9, =0.20.1-next.16, =0.22.1-next.0, =0.14.1-next.5, =0.17.1-next.0, =0.17.1-next.0, =0.22.1-next.9, =0.14.1-next.8, =0.17.1-next.19, =0.17.1-next.30, =0.0.1, =0.1.5 Source cves: CVE-2024-30253 Source advisory:...

@0xunreal/dynamic-amm-sdk (>=0.4.22, <=0.4.23), @0xunreal/vault-sdk (0.5.3) +58 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.66.0, <=1.66.2)

@solana/web3.js NPM version =1.66.0, =0.4.22, =2.0.0-alpha.1, =2.0.0-alpha.5, =2.0.0-alpha.1, =2.11.0-alpha.0, =0.1.0, =0.2.0-master.41, =1.9.0, =0.0.2, =1.10.0-alpha.6, =4.0.0-beta.5, =4.0.0-beta.5, =4.0.0-beta.14 and more Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@audius/sdk (0.0.36), @cardinal/squads-utils (>=0.0.2, <=0.0.6) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.53.0)

@solana/web3.js NPM version 1.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @audius/sdk 0.0.36 - @cardinal/squads-utils =0.0.2, =0.0.6 - @snowflake-so/wallet-adapter-snowflake 1.0.12 Source cves:...

@hubbleprotocol/hubble-sdk (>=1.0.48, <=2.0.24), @streamflow/stream (>=3.0.14-dev, <=3.0.19) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.42.0)

@solana/web3.js NPM version 1.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @hubbleprotocol/hubble-sdk =1.0.48, =3.0.14-dev, =2.0.0-rc.1, =2.0.2 Source cves: CVE-2024-30253 Source advisory:...

@axyzsdk/js (>=0.1.0-canary.0, <=0.2.1), @axyzsdk/react (>=0.1.0-canary.0, <=0.2.1) +13 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.36.0)

@solana/web3.js NPM version 1.36.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @axyzsdk/js =0.1.0-canary.0, =0.1.0-canary.0, =0.0.7, =0.0.2, =0.0.3, =2.0.8, =0.1.46, =1.1.135, =0.1.0-alpha-11, =0.3.0, =0.0.4,...

@cardinal/namespaces-components (>=4.1.0, <=5.0.0), @frakters/fusion-pool (>=1.0.0, <=1.0.4) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.32.0)

@solana/web3.js NPM version 1.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @cardinal/namespaces-components =4.1.0, =1.0.0, =0.0.29, =0.0.32 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J...

@strata-foundation/governance-cli (>=3.11.0, <=3.11.2) potentially affected by CVE-2024-30253 via @solana/web3.js (1.22.0)

@solana/web3.js NPM version 1.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @strata-foundation/governance-cli =3.11.0, =3.11.2 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@blockworks-foundation/mango-client (>=3.0.14, <=3.2.23), @frakters/community-pools-client-library-v2 (>=1.0.7, <=1.0.9) +11 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.21.0)

@solana/web3.js NPM version 1.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @blockworks-foundation/mango-client =3.0.14, =1.0.7, =1.0.1, =2.2.3, =0.0.6, =1.0.0, =0.0.1, =1.0.0, =1.2.5, =1.0.0, =1.0.0, =0.2....

@fabric-foundation/sdk (>=0.0.2, <=0.0.64), @zetamarkets/flex-sdk (0.1.0) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.18.0)

@solana/web3.js NPM version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @fabric-foundation/sdk =0.0.2, =0.6.15, =0.9.9 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

savour-snow (>=1.0.0, <=1.0.1) potentially affected by CVE-2024-30253 via @solana/web3.js (1.10.0)

@solana/web3.js NPM version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - savour-snow =1.0.0, =1.0.1 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@glow-app/glow-react (>=0.6.0, <=1.0.1), @glow-app/solana-client (>=0.5.2, <=1.0.4) +17 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.44.0, <=1.44.2)

@solana/web3.js NPM version =1.44.0, =0.6.0, =0.5.2, =1.1.0, =0.1.0, =1.0.5, =4.1.2, =4.1.3, =4.1.3, =0.1.20-beta-1, =0.2.40, =3.2.0, =0.0.50, =0.1.0, =0.1.2 and more Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

soltokenbalance (>=1.0.0, <=1.0.1) potentially affected by CVE-2024-30253 via @solana/web3.js (1.20.0)

@solana/web3.js NPM version 1.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - soltokenbalance =1.0.0, =1.0.1 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

GHSA-8M45-2RJM-J347 Handling untrusted input can result in a crash, leading to loss of availability / denial of service

Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a loss of availability...

@aurora-is-near/intents-swap-widget (>=3.17.2, <=7.19.0), @aurora-is-near/intents-swap-widget-standalone (>=6.0.0, <=7.19.0) +16 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.68.0)

@solana/web3.js NPM version 1.68.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @aurora-is-near/intents-swap-widget =3.17.2, =6.0.0, =0.17.1, =1.0.33, =2.18.0, =0.2.3, =0.9.0, =0.9.0, =0.21.4-beta, =0.72.0,...

@debridge-finance/solana-grpc (>=1.1.2, <=1.1.3), @mochi-web3/connect-wallet-widget (>=0.0.7, <=0.2.10) +2 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.74.0)

@solana/web3.js NPM version 1.74.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @debridge-finance/solana-grpc =1.1.2, =0.0.7, =0.2.2, =1.194.0, =1.261.0 Source cves: CVE-2024-30253 Source advisory:...