{"cve":"CVE-2024-30253","nvd":{"published":"2024-04-17T15:15:07.253","modified":"2026-06-17T07:26:36.630","status":"Deferred","description":"@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with `@solana/web3.js` will result in memory exhaustion (OOM). If you have a server, client, mobile, or desktop product that accepts untrusted input for use with `@solana/web3.js`, your application/service may crash, resulting in a loss of availability. This vulnerability is fixed in 1.0.1, 1.10.2, 1.11.1, 1.12.1, 1.1.2, 1.13.1, 1.14.1, 1.15.1, 1.16.2, 1.17.1, 1.18.1, 1.19.1, 1.20.3, 1.21.1, 1.22.1, 1.23.1, 1.24.3, 1.25.1, 1.26.1, 1.27.1, 1.28.1, 1.2.8, 1.29.4, 1.30.3, 1.31.1, 1.3.1, 1.32.3, 1.33.1, 1.34.1, 1.35.2, 1.36.1, 1.37.3, 1.38.1, 1.39.2, 1.40.2, 1.41.11, 1.4.1, 1.42.1, 1.43.7, 1.44.4, 1.45.1, 1.46.1, 1.47.5, 1.48.1, 1.49.1, 1.50.2, 1.51.1, 1.5.1, 1.52.1, 1.53.1, 1.54.2, 1.55.1, 1.56.3, 1.57.1, 1.58.1, 1.59.2, 1.60.1, 1.61.2, 1.6.1, 1.62.2, 1.63.2, 1.64.1, 1.65.1, 1.66.6, 1.67.3, 1.68.2, 1.69.1, 1.70.4, 1.71.1, 1.72.1, 1.7.2, 1.73.5, 1.74.1, 1.75.1, 1.76.1, 1.77.4, 1.78.8, 1.79.1, 1.80.1, 1.81.1, 1.8.1, 1.82.1, 1.83.1, 1.84.1, 1.85.1, 1.86.1, 1.87.7, 1.88.1, 1.89.2, 1.90.2, 1.9.2, and 1.91.3.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-119"],"references":["https://github.com/solana-labs/solana-web3.js/commit/77d935221a4805107b20b60ae7c1148725e4e2d0","https://github.com/solana-labs/solana-web3.js/security/advisories/GHSA-8m45-2rjm-j347","https://github.com/solana-labs/solana-web3.js/commit/77d935221a4805107b20b60ae7c1148725e4e2d0","https://github.com/solana-labs/solana-web3.js/security/advisories/GHSA-8m45-2rjm-j347"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:49:08.435428910+00:00"},"epss":{"cve":"CVE-2024-30253","score":0.00593,"percentile":0.48349,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-8m45-2rjm-j347","url":"https://osv.dev/vulnerability/GHSA-8m45-2rjm-j347","summary":"Handling untrusted input can result in a crash, leading to loss of availability / denial of service","modified":"2026-09-10T03:50:12.722446210Z","packages":[{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.91.0 <1.91.3"],"fixed":["1.91.3"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.90 <1.90.2"],"fixed":["1.90.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.89 <1.89.2"],"fixed":["1.89.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.88.0 <1.88.1"],"fixed":["1.88.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.87.0 <1.87.7"],"fixed":["1.87.7"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.86.0 <1.86.1"],"fixed":["1.86.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.85.0 <1.85.1"],"fixed":["1.85.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.84.0 <1.84.1"],"fixed":["1.84.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.83.0 <1.83.1"],"fixed":["1.83.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.82.0 <1.82.1"],"fixed":["1.82.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.81.0 <1.81.1"],"fixed":["1.81.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.80.0 <1.80.1"],"fixed":["1.80.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.79.0 <1.79.1"],"fixed":["1.79.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.78 <1.78.8"],"fixed":["1.78.8"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.77 <1.77.4"],"fixed":["1.77.4"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.76.0 <1.76.1"],"fixed":["1.76.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.75.0 <1.75.1"],"fixed":["1.75.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.74.0 <1.74.1"],"fixed":["1.74.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.73.0 <1.73.5"],"fixed":["1.73.5"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.72.0 <1.72.1"],"fixed":["1.72.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.71.0 <1.71.1"],"fixed":["1.71.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.70.0 <1.70.4"],"fixed":["1.70.4"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.69.0 <1.69.1"],"fixed":["1.69.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.68.0 <1.68.2"],"fixed":["1.68.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.67.0 <1.67.3"],"fixed":["1.67.3"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.66.0 <1.66.6"],"fixed":["1.66.6"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.65.0 <1.65.1"],"fixed":["1.65.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.64.0 <1.64.1"],"fixed":["1.64.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.63.0 <1.63.2"],"fixed":["1.63.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.62.0 <1.62.2"],"fixed":["1.62.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.61.0 <1.61.2"],"fixed":["1.61.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.60.0 <1.60.1"],"fixed":["1.60.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.59.0 <1.59.2"],"fixed":["1.59.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.58.0 <1.58.1"],"fixed":["1.58.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.57.0 <1.57.1"],"fixed":["1.57.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.56.0 <1.56.3"],"fixed":["1.56.3"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.55.0 <1.55.1"],"fixed":["1.55.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.54.0 <1.54.2"],"fixed":["1.54.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.53.0 <1.53.1"],"fixed":["1.53.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.52.0 <1.52.1"],"fixed":["1.52.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.51.0 <1.51.1"],"fixed":["1.51.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.50.0 <1.50.2"],"fixed":["1.50.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.49.0 <1.49.1"],"fixed":["1.49.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.48.0 <1.48.1"],"fixed":["1.48.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.47.0 <1.47.5"],"fixed":["1.47.5"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.46.0 <1.46.1"],"fixed":["1.46.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.45.0 <1.45.1"],"fixed":["1.45.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.44.0 <1.44.4"],"fixed":["1.44.4"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.43.0 <1.43.7"],"fixed":["1.43.7"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.42.0 <1.42.1"],"fixed":["1.42.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.41.0 <1.41.11"],"fixed":["1.41.11"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.40.0 <1.40.2"],"fixed":["1.40.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.39.0 <1.39.2"],"fixed":["1.39.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.38.0 <1.38.1"],"fixed":["1.38.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.37.0 <1.37.3"],"fixed":["1.37.3"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.36.0 <1.36.1"],"fixed":["1.36.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.35.0 <1.35.2"],"fixed":["1.35.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.34.0 <1.34.1"],"fixed":["1.34.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.33.0 <1.33.1"],"fixed":["1.33.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.32.0 <1.32.2"],"fixed":["1.32.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.31.0 <1.31.1"],"fixed":["1.31.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.30.0 <1.30.3"],"fixed":["1.30.3"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.29.0 <1.29.4"],"fixed":["1.29.4"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.28.0 <1.28.1"],"fixed":["1.28.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.27.0 <1.27.1"],"fixed":["1.27.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.26.0 <1.26.1"],"fixed":["1.26.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.25.0 <1.25.1"],"fixed":["1.25.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.24.0 <1.24.3"],"fixed":["1.24.3"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.23.0 <1.23.1"],"fixed":["1.23.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.22.0 <1.22.1"],"fixed":["1.22.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.21.0 <1.21.1"],"fixed":["1.21.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.20.0 <1.20.3"],"fixed":["1.20.3"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.19.0 <1.19.1"],"fixed":["1.19.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.18.0 <1.18.1"],"fixed":["1.18.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.17.0 <1.17.1"],"fixed":["1.17.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.16.0 <1.16.2"],"fixed":["1.16.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.15.0 <1.15.1"],"fixed":["1.15.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.14.0 <1.14.1"],"fixed":["1.14.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.13.0 <1.13.1"],"fixed":["1.13.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.12.0 <1.12.1"],"fixed":["1.12.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.11.0 <1.11.1"],"fixed":["1.11.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.10.0 <1.10.2"],"fixed":["1.10.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.9.0 <1.9.2"],"fixed":["1.9.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.8.0 <1.8.1"],"fixed":["1.8.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.7.0 <1.7.2"],"fixed":["1.7.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.6.0 <1.6.1"],"fixed":["1.6.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.5.0 <1.5.1"],"fixed":["1.5.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.4.0 <1.4.1"],"fixed":["1.4.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.3.0 <1.3.1"],"fixed":["1.3.1"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.2.0 <1.2.8"],"fixed":["1.2.8"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":[">=1.1.0 <1.1.2"],"fixed":["1.1.2"]},{"ecosystem":"npm","name":"@solana/web3.js","purl":"pkg:npm/%40solana/web3.js","ranges":["<1.0.1"],"fixed":["1.0.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}