{"action":"Upgrade @openzeppelin/contracts to 5.4.0 or later.","affected":[{"fixed":"5.4.0","introduced":"5.2.0"}],"component":"@openzeppelin/contracts","cve_ids":["CVE-2025-54070"],"ecosystem":"npm","epss":0.00399,"exploited":false,"fixed_versions":["5.4.0"],"ghsa_id":"GHSA-9rcw-c2f9-2j55","id":"tcs_01M5KFGW44F75V2WQDPC018FXC","modified_at":"2025-07-17T22:06:46Z","published_at":"2025-07-17T21:19:32Z","references":["https://osv.dev/vulnerability/GHSA-9rcw-c2f9-2j55","https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9rcw-c2f9-2j55","https://nvd.nist.gov/vuln/detail/CVE-2025-54070","https://github.com/OpenZeppelin/openzeppelin-contracts/pull/5797","https://github.com/OpenZeppelin/openzeppelin-contracts","https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v5.4.0"],"severity":{"label":"unknown","score":0},"sources":[{"source":"osv","source_id":"GHSA-9rcw-c2f9-2j55","url":"https://osv.dev/vulnerability/GHSA-9rcw-c2f9-2j55"}],"summary":"OpenZeppelin Contracts Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers"}