solana-web3.js vulnerabilities

2 known vulnerabilities in solana-web3.js from Solana-labs. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.3 High severity

  solana-web3.js: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2024-54134Dec 4, 2024Solana-labs

  A publish-access account was compromised for `@solana/web3.js`, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material

• 7.5 High severity

  solana-web3.js: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2024-30253Apr 17, 2024Solana-labs

  @solana/web3.js is the Solana JavaScript SDK. Using particular inputs with `@solana/web3.js` will result in memory exhaustion (OOM). If you have a server, client, mobile, or desktop product that accepts untrusted input for use with `@solana/web3.js`, your appl