Executive brief
@zag-js/core is a state machine library used in web applications and component frameworks. A prototype pollution flaw in its deepMerge function allows attackers to cause denial-of-service by submitting specially crafted data, potentially disrupting service availability for users relying on affected applications.
Technical details
The vulnerability is a prototype pollution flaw in the lib.deepMerge function of @zag-js/core (all versions prior to 0.82.2). An attacker can supply a maliciously crafted payload to trigger prototype pollution, leading to a Denial of Service condition. The vulnerability requires network access but no authentication or user interaction. Successful exploitation corrupts the prototype chain and causes application crashes or hangs. A patch is available in version 0.82.2 and later.
Affected products
- Chakra UI @zag-js/core all versions before 0.82.2
Timeline
- 2025-02-05: disclosed: CVE-2024-57079 published
- 2025-02-21: patched: Fix merged via PR #2255; patched in version 0.82.2