Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@openzeppelin/contracts

19 known vulnerabilities (2 critical, 4 high, 12 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
19 · 2 critical, 4 high, 12 medium
Registry
npm

Advisories 19

  • CVE-2025-54070Medium 6.9

    OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers

    Affected: from 5.2.0, fixed in 5.4.0.

  • CVE-2024-27094Medium 6.5

    OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

    Affected: from 4.5.0, fixed in 4.9.6; from 5.0.0-rc.0, fixed in 5.0.2.

  • CVE-2023-49798Medium 5.9

    Duplicated execution of subcalls in OpenZeppelin Contracts

    Affected: from 4.9.4, fixed in 4.9.5.

  • CVE-2023-40014Medium 5.3

    OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender

    Affected: from 4.0.0, fixed in 4.9.3.

  • CVE-2023-34459Medium 5.3

    OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees

    Affected: from 4.7.0, fixed in 4.9.2.

  • CVE-2023-34234Medium 5.3

    Governor proposal creation may be blocked by frontrunning in OpenZeppelin

    Affected: from 4.3.0, fixed in 4.9.1.

  • CVE-2023-30541Medium 5.3

    TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts

    Affected: from 3.2.0, fixed in 4.8.3.

  • CVE-2023-30542Medium 6.8

    GovernorCompatibilityBravo may trim proposal calldata

    Affected: from 4.3.0, fixed in 4.8.3.

  • CVE-2023-26488Medium 6.5

    OpenZeppelin Contracts contains Incorrect Calculation

    Affected: from 4.8.0, fixed in 4.8.2.

  • CVE-2022-39384Medium 5.6

    OpenZeppelin Contracts initializer reentrancy may lead to double initialization

    Affected: fixed in 4.4.1; from 3.2.0, fixed in 4.4.1.

  • ECDSA signature malleability in OpenZeppelin Contracts

    Affected: from 4.1.0, fixed in 4.7.3.

  • CVE-2022-35915Medium 5.3

    Unbounded gas consumption in @openzeppelin/contracts

    Affected: from 2.0.0, fixed in 4.7.2.

  • CVE-2022-35916Medium 5.3

    Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls

    Affected: from 4.6.0, fixed in 4.7.2.

  • GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts

    Affected: from 4.3.0, fixed in 4.7.2.

  • OpenZeppelin Contracts's ERC165Checker may revert instead of returning false

    Affected: from 4.0.0, fixed in 4.7.1.

Show all 19 advisoriesShow fewer advisories

  • OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers

    Affected: from 4.1.0, fixed in 4.7.1.

  • In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal…

    Affected: fixed in 4.4.1; from 3.2.0, fixed in 4.4.1.

  • CVE-2021-41264Critical 9.8

    UUPSUpgradeable vulnerability in OpenZeppelin Contracts

    Affected: from 4.1.0, fixed in 4.3.2.

  • CVE-2021-39167Critical 10.0

    TimelockController vulnerability in OpenZeppelin Contracts

    Affected: from 4.0.0, fixed in 4.3.1; from 3.3.0, fixed in 3.4.2.