CVE-2024-57079: @zag-js/core prototype pollution

February 6, 2025 (updated March 19, 2025)

A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

References

gist.github.com/tariqhawis/4778fc57084766b7b7fb6d25d20b7b9b
github.com/advisories/GHSA-fg4m-w35q-vfg2
github.com/chakra-ui/zag
github.com/chakra-ui/zag/commit/f53edc548f737aadfdd486a0043bdd5f5c068bbf
github.com/chakra-ui/zag/pull/2255
nvd.nist.gov/vuln/detail/CVE-2024-57079

Code Behaviors & Features

Detect and mitigate CVE-2024-57079 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →