CVE-2024-57077: utils-extend Prototype Pollution

February 6, 2025 (updated September 3, 2025)

The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.

References

gist.github.com/tariqhawis/64bac50f8c2706e6880e45d50a507114
github.com/advisories/GHSA-7qgg-vw88-cc99
github.com/douzi8/utils-extend
nvd.nist.gov/vuln/detail/CVE-2024-57077

Code Behaviors & Features

Detect and mitigate CVE-2024-57077 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →