{"action":"Upgrade @openzeppelin/confidential-contracts to 0.3.1 or later.","affected":[{"fixed":"0.3.1","introduced":"0"}],"component":"@openzeppelin/confidential-contracts","cve_ids":["CVE-2026-73645"],"ecosystem":"npm","epss":0.00524,"exploited":false,"fixed_versions":["0.3.1"],"ghsa_id":"GHSA-hqf9-8xv5-x8xw","id":"tcs_01M5KFVTJDAK9T2D6F9XGY9ZC6","modified_at":"2026-08-13T18:51:16.040451Z","published_at":"2026-01-05T19:57:46Z","references":["https://osv.dev/vulnerability/GHSA-hqf9-8xv5-x8xw","https://github.com/OpenZeppelin/openzeppelin-confidential-contracts/security/advisories/GHSA-hqf9-8xv5-x8xw","https://github.com/OpenZeppelin/openzeppelin-confidential-contracts"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-hqf9-8xv5-x8xw","url":"https://osv.dev/vulnerability/GHSA-hqf9-8xv5-x8xw"}],"summary":"ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds."}