CVE-2024-57068
Published: 05 February 2025
Description
A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
Security Summary
CVE-2024-57068 is a prototype pollution vulnerability in the lib.mutateMergeDeep function of @tanstack/form-core version 0.35.0. This issue allows attackers to cause a Denial of Service (DoS) condition by supplying a crafted payload. The vulnerability is classified under CWE-732 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its potential for high availability impact.
Attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no authentication privileges or user interaction. Successful exploitation results in a DoS, disrupting service availability without compromising confidentiality or integrity.
Mitigation details are provided in the advisory referenced at https://gist.github.com/tariqhawis/47fe5b1e584e9e573c0933588248d533.
Details
- CWE(s)