Skip to content

@openzeppelin/contracts-upgradeable vulnerabilities (npm)

23 vulnerabilities.

@openzeppelin/contracts-upgradeable npm OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers CVE-2025-54070 Fix available 6.9 MediumJuly 17, 2025
@openzeppelin/contracts-upgradeable npm OpenZeppelin Contracts base64 encoding may read from potentially dirty memory CVE-2024-27094 Fix available 6.5 MediumFebruary 29, 2024
@openzeppelin/contracts-upgradeable npm Duplicated execution of subcalls in OpenZeppelin Contracts CVE-2023-49798 Fix available 5.9 MediumDecember 8, 2023
@openzeppelin/contracts-upgradeable npm OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSender CVE-2023-40014 Fix available 5.3 MediumAugust 10, 2023
@openzeppelin/contracts-upgradeable npm OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific trees CVE-2023-34459 Fix available 5.3 MediumJune 16, 2023
@openzeppelin/contracts-upgradeable npm Governor proposal creation may be blocked by frontrunning in OpenZeppelin CVE-2023-34234 Fix available 5.3 MediumJune 7, 2023
@openzeppelin/contracts-upgradeable npm TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts CVE-2023-30541 Fix available 5.3 MediumApril 17, 2023
@openzeppelin/contracts-upgradeable npm GovernorCompatibilityBravo may trim proposal calldata CVE-2023-30542 Fix available 6.8 MediumApril 16, 2023
@openzeppelin/contracts-upgradeable npm OpenZeppelin Contracts contains Incorrect Calculation CVE-2023-26488 Fix available 6.5 MediumMarch 3, 2023
@openzeppelin/contracts-upgradeable npm ECDSA signature malleability in OpenZeppelin Contracts CVE-2022-35961 Fix available 7.9 HighAugust 14, 2022
@openzeppelin/contracts-upgradeable npm Unbounded gas consumption in @openzeppelin/contracts CVE-2022-35915 Fix available 5.3 MediumAugust 1, 2022
@openzeppelin/contracts-upgradeable npm Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls CVE-2022-35916 Fix available 5.3 MediumAugust 1, 2022
@openzeppelin/contracts-upgradeable npm GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts CVE-2022-31198 Fix available 7.5 HighAugust 1, 2022
@openzeppelin/contracts-upgradeable npm OpenZeppelin Contracts's ERC165Checker may revert instead of returning false CVE-2022-31170 Fix available 7.5 HighJuly 21, 2022
@openzeppelin/contracts-upgradeable npm OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers CVE-2022-31172 Fix available 7.5 HighJuly 21, 2022
@openzeppelin/contracts-upgradeable npm Inconsistent storage layout for ERC2771ContextUpgradeable GHSA-7j52-6fjp-58gr Fix available No scoreMarch 14, 2022
@openzeppelin/contracts-upgradeable npm GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior GHSA-m6w8-fq7v-ph4m Fix available No scoreJanuary 13, 2022
@openzeppelin/contracts-upgradeable npm OpenZeppelin Contracts initializer reentrancy may lead to double initialization CVE-2022-39384 Fix available 5.6 MediumDecember 14, 2021
@openzeppelin/contracts-upgradeable npm Improper Initialization in OpenZeppelin CVE-2021-46320 Fix available 7.5 HighDecember 14, 2021
@openzeppelin/contracts-upgradeable npm ERC1155Supply vulnerability in OpenZeppelin Contracts GHSA-wmpv-c2jp-j2xg Fix available No scoreNovember 15, 2021
@openzeppelin/contracts-upgradeable npm UUPSUpgradeable vulnerability in OpenZeppelin Contracts CVE-2021-41264 Fix available 9.8 CriticalSeptember 15, 2021
@openzeppelin/contracts-upgradeable npm UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable GHSA-q4h9-46xg-m3x9 Fix available No scoreSeptember 15, 2021
@openzeppelin/contracts-upgradeable npm TimelockController vulnerability in OpenZeppelin Contracts CVE-2021-39168 Fix available 10.0 CriticalAugust 26, 2021