CVE-2024-57081
Published: 05 February 2025
Description
A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
Security Summary
CVE-2024-57081 is a prototype pollution vulnerability in the lib.fromQuery function of the underscore-contrib library version 0.3.0. This issue allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is classified under CWE-400 (Uncontrolled Resource Consumption). It was published on 2025-02-05.
Attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges or user interaction. Successful exploitation leads to high-impact disruption of availability, such as resource exhaustion, without affecting confidentiality or integrity.
Mitigation details and additional information are available in the referenced advisory at https://gist.github.com/tariqhawis/4b2c7273054f0d70ef162aa5b6daec01.
Details
- CWE(s)