What is GHSA-9rhg-254w-fh9x?

GHSA-9rhg-254w-fh9x is a security advisory published by GitHub Security Advisories with High severity. Redoc Prototype Pollution via `Module.mergeObjects` Component

Which CVE IDs does GHSA-9rhg-254w-fh9x cover?

GHSA-9rhg-254w-fh9x covers the following CVE IDs: CVE-2024-57083. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-9rhg-254w-fh9x?

GHSA-9rhg-254w-fh9x affects 1 product, including: npm/redoc:\u003c 2.4.0.

GHSA-9rhg-254w-fh9xHigh

Redoc Prototype Pollution via `Module.mergeObjects` Component

Vendor

GitHub Security Advisories

Published

March 28, 2025

Last Modified

March 31, 2025

🔗 CVE IDs covered (1)

CVE-2024-57083 →

📋 Description

A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

🎯 Affected products1

npm/redoc:< 2.4.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-57083
https://github.com/Redocly/redoc/issues/2499
https://github.com/Redocly/redoc/pull/2638
https://github.com/advisories/GHSA-9rhg-254w-fh9x