# @openzeppelin/contracts-upgradeable (npm) vulnerabilities

19 known vulnerabilities (2 critical, 4 high, 12 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://www.npmjs.com/package/@openzeppelin/contracts-upgradeable

## Advisories (19)

### [CVE-2025-54070](https://cve.now/CVE-2025-54070): OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers

- Severity: Medium 6.9
- Published: Jul 17, 2025
- Affected: from 5.2.0, fixed in 5.4.0.

### [CVE-2024-27094](https://cve.now/CVE-2024-27094): OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

- Severity: Medium 6.5
- Published: Feb 29, 2024
- Affected: from 5.0.0-rc.0, fixed in 5.0.2; from 4.5.0, fixed in 4.9.6.

### [CVE-2023-49798](https://cve.now/CVE-2023-49798): Duplicated execution of subcalls in OpenZeppelin Contracts

- Severity: Medium 5.9
- Published: Dec 8, 2023
- Affected: from 4.9.4, fixed in 4.9.5.

### [CVE-2023-40014](https://cve.now/CVE-2023-40014): OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued \_msgSender

- Severity: Medium 5.3
- Published: Aug 10, 2023
- Affected: from 4.0.0, fixed in 4.9.3.

### [CVE-2023-34459](https://cve.now/CVE-2023-34459): OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees

- Severity: Medium 5.3
- Published: Jun 16, 2023
- Affected: from 4.7.0, fixed in 4.9.2.

### [CVE-2023-34234](https://cve.now/CVE-2023-34234): Governor proposal creation may be blocked by frontrunning in OpenZeppelin

- Severity: Medium 5.3
- Published: Jun 7, 2023
- Affected: from 4.3.0, fixed in 4.9.1.

### [CVE-2023-30541](https://cve.now/CVE-2023-30541): TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts

- Severity: Medium 5.3
- Published: Apr 17, 2023
- Affected: from 3.2.0, fixed in 4.8.3.

### [CVE-2023-30542](https://cve.now/CVE-2023-30542): GovernorCompatibilityBravo may trim proposal calldata

- Severity: Medium 6.8
- Published: Apr 16, 2023
- Affected: from 4.3.0, fixed in 4.8.3.

### [CVE-2023-26488](https://cve.now/CVE-2023-26488): OpenZeppelin Contracts contains Incorrect Calculation

- Severity: Medium 6.5
- Published: Mar 3, 2023
- Affected: from 4.8.0, fixed in 4.8.2.

### [CVE-2022-39384](https://cve.now/CVE-2022-39384): OpenZeppelin Contracts initializer reentrancy may lead to double initialization

- Severity: Medium 5.6
- Published: Nov 4, 2022
- Affected: from 3.2.0, fixed in 4.4.1.

### [CVE-2022-35961](https://cve.now/CVE-2022-35961): ECDSA signature malleability in OpenZeppelin Contracts

- Severity: High 7.9
- Published: Aug 14, 2022
- Affected: from 4.1.0, fixed in 4.7.3.

### [CVE-2022-35915](https://cve.now/CVE-2022-35915): Unbounded gas consumption in @openzeppelin/contracts

- Severity: Medium 5.3
- Published: Aug 1, 2022
- Affected: from 3.2.0, fixed in 4.7.2.

### [CVE-2022-35916](https://cve.now/CVE-2022-35916): Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls

- Severity: Medium 5.3
- Published: Aug 1, 2022
- Affected: from 4.6.0, fixed in 4.7.2.

### [CVE-2022-31198](https://cve.now/CVE-2022-31198): GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts

- Severity: High 7.5
- Published: Aug 1, 2022
- Affected: from 4.3.0, fixed in 4.7.2.

### [CVE-2022-31170](https://cve.now/CVE-2022-31170): OpenZeppelin Contracts's ERC165Checker may revert instead of returning false

- Severity: High 7.5
- Published: Jul 21, 2022
- Affected: from 4.0.0, fixed in 4.7.1.

### [CVE-2022-31172](https://cve.now/CVE-2022-31172): OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers

- Severity: High 7.5
- Published: Jul 21, 2022
- Affected: from 4.1.0, fixed in 4.7.1.

### [CVE-2021-46320](https://cve.now/CVE-2021-46320): In OpenZeppelin \<=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal…

- Severity: Unrated
- Published: Feb 4, 2022
- Affected: from 3.2.0, fixed in 4.4.1.

### [CVE-2021-41264](https://cve.now/CVE-2021-41264): UUPSUpgradeable vulnerability in OpenZeppelin Contracts

- Severity: Critical 9.8
- Published: Nov 12, 2021
- Affected: from 4.1.0, fixed in 4.3.2.

### [CVE-2021-39168](https://cve.now/CVE-2021-39168): TimelockController vulnerability in OpenZeppelin Contracts

- Severity: Critical 10.0
- Published: Aug 26, 2021
- Affected: from 4.0.0, fixed in 4.3.1; from 3.3.0, fixed in 3.4.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/@openzeppelin/contracts-upgradeable
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.