CVE-2024-57079

CVE-2024-57079, published on 2025-02-05, is a prototype pollution vulnerability in the lib.deepMerge function of the @zag-js/core package version 0.50.0. This flaw enables attackers to cause a Denial of Service (DoS) condition by supplying a crafted payload. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability, and is classified under CWE-400 (Uncontrolled Resource Consumption).

The vulnerability is exploitable by unauthenticated attackers over the network with low attack complexity and no requirement for user interaction. By delivering a specially crafted payload to applications using the affected lib.deepMerge function, attackers can trigger resource exhaustion, resulting in a DoS that disrupts service availability without compromising confidentiality or integrity.

Mitigation details are available in the referenced advisory at https://gist.github.com/tariqhawis/4778fc57084766b7b7fb6d25d20b7b9b.