CVE-2024-57077 utils-extend Prototype Pollution
Prototype pollution in utils-extend allows attackers to modify the global prototype chain, potentially causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-57077?
CVE-2024-57077 is a critical vulnerability in n/a, published on 5 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.
Weakness: CWE-1321
Which versions are affected by CVE-2024-57077?
2 open source packages ship an affected version, including utils-extend.
| Package | Affected | Fixed in |
|---|---|---|
utils-extend npm | All versions to 1.0.8 | None |
utils-extend npm | All versions to 1.0.8 | None |
How do I fix CVE-2024-57077?
Upgrade to a fixed version.
Is CVE-2024-57077 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-57077 exists.
Sources
Also known as GHSA-7qgg-vw88-cc99.