solana @solana/web3.js vulnerabilities

Latest solana @solana/web3.js CVEs

Newest publication first

1. CVE-2024-54134 @solana/web3.js modified package published to npm, containing malware that exfiltrates private key material

   Published 2024-12-04

   High·CVSS 8.3 EPSS 0.54%

   A publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from d...

2. CVE-2024-30253 Handling untrusted input can result in a crash, leading to loss of availability / denial of service

   Published 2024-04-17

   High·CVSS 7.5 EPSS 0.59%

   @solana/web3.js is the Solana JavaScript SDK. Using particular inputs with @solana/web3.js will result in memory exhaustion (OOM). If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may cras...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.