CVE-2024-57079
Published: 05 February 2025
Summary
CVE-2024-57079 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 41.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-6 (Resource Availability) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-57079, published on 2025-02-05, is a prototype pollution vulnerability in the lib.deepMerge function of the @zag-js/core package version 0.50.0. This flaw enables attackers to cause a Denial of Service (DoS) condition by supplying a crafted payload. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability, and is classified under CWE-400 (Uncontrolled Resource Consumption).
The vulnerability is exploitable by unauthenticated attackers over the network with low attack complexity and no requirement for user interaction. By delivering a specially crafted payload to applications using the affected lib.deepMerge function, attackers can trigger resource exhaustion, resulting in a DoS that disrupts service availability without compromising confidentiality or integrity.
Mitigation details are available in the referenced advisory at https://gist.github.com/tariqhawis/4778fc57084766b7b7fb6d25d20b7b9b.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53522
Vulnerability details
A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Prototype pollution in deepMerge directly enables remote unauthenticated exploitation for application DoS via resource exhaustion (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly mitigates CVE-2024-57079 by requiring timely patching or updating of the vulnerable @zag-js/core v0.50.0 library to eliminate the prototype pollution vulnerability.
Resource availability protections restrict allocation and monitor exhaustion of resources like memory or CPU, directly countering the uncontrolled resource consumption DoS caused by crafted payloads in deepMerge.
Information input validation ensures crafted payloads cannot be processed by the deepMerge function, preventing prototype pollution and subsequent DoS.