@cardinal/namespaces-components (>=4.1.0 <=5.0.0), @frakters/fusion-pool (>=1.0.0 <=1.0.4) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (=1.32.0)

@solana/web3.js NPM version =1.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @cardinal/namespaces-components =4.1.0, =1.0.0, =0.0.29, =0.0.32 Source cves: CVE-2024-30253 Source advisory:...

@audius/sdk (>=0.0.3 <=3.0.8-beta.12), @audius/stems (>=1.5.2-beta.1 <=1.5.4) +14 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.37.0 <=1.37.2)

@solana/web3.js NPM version =1.37.0, =0.0.3, =1.5.2-beta.1, =0.0.3, =0.0.1, =0.2.0, =1.5.1, =0.3.3, =3.2.8, =3.3.0 - @winter-love/wallet =1.0.25-alpha.14 - kyzr-marketplace-sdk =0.0.1 and more Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@civic/multichain-connect-react-solana-wallet-adapter (>=0.0.0-alpha.1 <=0.0.3-beta.11), @debridge-finance/dln-client (>=5.1.0 <=8.2.2) +6 more potentially affected by CVE-2024-30253 via @solana/web3.js (=1.76.0)

@solana/web3.js NPM version =1.76.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @civic/multichain-connect-react-solana-wallet-adapter =0.0.0-alpha.1, =5.1.0, =2.11.0, =1.0.0, =0.1.1-alpha.8, =0.3.2-alpha.2,...

@neoswap/solana-collection-swap (=0.1.6-Beta1), @orbiter-finance/balances (>=0.0.18 <=0.0.21) +2 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.91.1 <=1.91.2)

@solana/web3.js NPM version =1.91.1, =0.0.18, =4.1.2, =2.2.5, =6.1.2 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

soltokenbalance (>=1.0.0 <=1.0.1) potentially affected by CVE-2024-30253 via @solana/web3.js (=1.20.0)

@solana/web3.js NPM version =1.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - soltokenbalance =1.0.0, =1.0.1 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@glow-app/solana-client (>=0.4.0 <=0.5.1), @zetamarkets/flex-sdk (>=0.6.3 <=0.15.0) +8 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.43.4 <=1.43.6)

@solana/web3.js NPM version =1.43.4, =0.4.0, =0.6.3, =0.1.1, =0.0.1, =1.4.0, =0.1.0, =1.0.4, =1.4.1 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

@0xunreal/dynamic-amm-sdk (>=0.4.22 <=0.4.23), @0xunreal/vault-sdk (=0.5.3) +57 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.66.0 <=1.66.2)

@solana/web3.js NPM version =1.66.0, =0.4.22, =2.0.0-alpha.1, =2.0.0-alpha.5, =2.0.0-alpha.1, =2.11.0, =0.1.0, =0.2.0-master.41, =1.9.0, =0.0.2, =4.0.0-beta.5, =4.0.0-beta.5, =0.7.0, =0.7.1 and more Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

Handling untrusted input can result in a crash, leading to loss of availability / denial of service

Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a loss of availability...

GHSA-8M45-2RJM-J347 Handling untrusted input can result in a crash, leading to loss of availability / denial of service

Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a loss of availability...

CVE-2024-30253 Handling untrusted input can result in a crash, leading to loss of availability / denial of service

@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a...

web3.js 安全漏洞

Web3.js is a TypeScript implementation of the Ethernet JSON RPC API open-sourced by Web3 and related tools maintained by ChainSafe Systems. A security vulnerability exists in solana/web3.js that stems from allowing an attacker to cause an out-of-memory OOM using specific input...

PT-2024-23300 · Solana · @Solana/Web3.Js

Name of the Vulnerable Software and Affected Versions: @solana/web3.js versions prior to 1.0.1 @solana/web3.js versions prior to 1.10.2 @solana/web3.js versions prior to 1.11.1 @solana/web3.js versions prior to 1.12.1 @solana/web3.js versions prior to 1.1.2 @solana/web3.js versions prior to 1.13....