GHSA-2j4c-9qqq-896r

web3-core-method is vulnerable to prototype pollution

Source: GitHub Advisory Database (reviewed) Low CVE-2025-57329

Packages

Ecosystem	Package	Affected	Fixed in
npm	web3-core-method	<= 1.10.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

web3-core-method is a package designed to creates the methods on the web3 modules. A Prototype Pollution vulnerability in the attachToObject function of web3-core-method version 1.10.4 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-57329 advisory
https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/web3-core-method%401.10.4/index.js web
https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57329 web
https://github.com/web3/web3.js/tree/1.x package