Executive brief
@tanstack/form-core is a JavaScript library used to manage form state in web applications. A prototype pollution vulnerability in its deep-merge function allows attackers to inject malicious properties into the application's object prototypes by sending crafted payloads, potentially causing denial of service or unexpected application behavior. This affects all versions prior to 0.42.1.
Technical details
The vulnerability is a prototype pollution flaw in the lib.mutateMergeDeep function of @tanstack/form-core. The vulnerable component fails to safely validate property assignments when merging objects, allowing attackers to inject dangerous properties such as __proto__ and constructor. An unauthenticated attacker can exploit this via a crafted payload sent to any application using affected versions, triggering a denial of service condition. The fix, available in version 0.42.1 and merged in PR #1151 on February 20, 2025, adds property safety validation to prevent assignment to dangerous properties during the merge operation.
Affected products
- TanStack form-core all versions before 0.42.1
Timeline
- 2025-02-06: disclosed: GHSA published
- 2025-02-05: advisory: NVD published CVE-2024-57068
- 2025-02-20: patched: Fix merged in PR #1151; version 0.42.1 released