Is CVE-2024-57068 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-57068 being exploited in the wild.

How severe is CVE-2024-57068?

Low severity, with a CVSS score of 3.1, published 6 February 2025.

Which products and versions are affected?

@tanstack/form-core (npm) SEMVER:introduced=0,fixed=0.42.1; TanStack Form-Core all versions before 0.42.1.

Is there a fix for CVE-2024-57068?

Yes. @tanstack/form-core (npm): upgrade to 0.42.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-57068 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-57068?

Check whether you run @tanstack/form-core (npm) or TanStack Form-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-57068: TanStack form-core prototype pollution in mutateMergeDeep

CVE-2024-57068 · Severity: low · CVSS 3.1 · Published 2025-02-06

@tanstack/form-core is a JavaScript library used to manage form state in web applications. A prototype pollution vulnerability in its deep-merge function allows attackers to inject malicious properties into the application's object prototypes by sending crafted payloads, potentially causing denial of service or unexpected application behavior. This affects all versions prior to 0.42.1.

Vendors: npm, TanStack.

Quick answers

Is CVE-2024-57068 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-57068 being exploited in the wild.
How severe is CVE-2024-57068?: Low severity, with a CVSS score of 3.1, published 6 February 2025.
Which products and versions are affected?: @tanstack/form-core (npm) SEMVER:introduced=0,fixed=0.42.1; TanStack Form-Core all versions before 0.42.1.
Is there a fix for CVE-2024-57068?: Yes. @tanstack/form-core (npm): upgrade to 0.42.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-57068 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-57068?: Check whether you run @tanstack/form-core (npm) or TanStack Form-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@tanstack/form-core (npm): upgrade to 0.42.1 or later
```
npm install @tanstack/form-core@0.42.1
```

Technical details

The vulnerability is a prototype pollution flaw in the lib.mutateMergeDeep function of @tanstack/form-core. The vulnerable component fails to safely validate property assignments when merging objects, allowing attackers to inject dangerous properties such as __proto__ and constructor. An unauthenticated attacker can exploit this via a crafted payload sent to any application using affected versions, triggering a denial of service condition. The fix, available in version 0.42.1 and merged in PR #1151 on February 20, 2025, adds property safety validation to prevent assignment to dangerous properties during the merge operation.

Affected products

TanStack form-core all versions before 0.42.1

Identifiers

CVE-2024-57068
GHSA-ggv3-vmgw-xv2q

Timeline

2025-02-06: disclosed: GHSA published
2025-02-05: advisory: NVD published CVE-2024-57068
2025-02-20: patched: Fix merged in PR #1151; version 0.42.1 released

References

https://github.com/TanStack/form/pull/1151

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.