high7.5
CVE-2024-57068
@tanstack/form-core prototype pollution
Impact
A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @tanstack/form-core | < 0.42.1 | 0.42.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/tariqhawis/47fe5b1e584e9e573c0933588248d533
- https://github.com/advisories/GHSA-ggv3-vmgw-xv2q
- https://nvd.nist.gov/vuln/detail/CVE-2024-57068
- https://github.com/TanStack/form/pull/1151
- https://github.com/TanStack/form/commit/455522c8f3272787668f3d1afd6adbc6dc1b9e8a