npm/@openzeppelin/contracts CVE-2021-46320, CVE-2022-39384: high 7.5, EPSS 1.22%

Improper Initialization in OpenZeppelin

Action: Upgrade @openzeppelin/contracts to 4.4.1 or later.

npm i @openzeppelin/contracts@4.4.1

Affected

Fixed versions

Sources

• osv: GHSA-88g8-f5mf-f5rj
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9c22-pwxw-p6hx
• https://nvd.nist.gov/vuln/detail/CVE-2021-46320
• https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3006
• https://github.com/OpenZeppelin/openzeppelin-contracts
• https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.4.1

CVE-2021-46320, CVE-2022-39384 · published 2022-02-05T00:00:31Z · modified 2026-07-16T03:56:17.546633851Z · JSON