redocly redoc vulnerabilities

Latest redocly redoc CVEs

Newest publication first

1. CVE-2024-57083 Redoc Prototype Pollution via `Module.mergeObjects` Component

   Published 2025-03-28

   High·CVSS 7.5 EPSS 0.56%

   A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

2. CVE-2024-39011 Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the function mergeObjects.

   Published 2024-07-30

   Critical·CVSS 9.8 EPSS 0.91%

   Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the function mergeObjects.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.