CVE-2025-54070: @openzeppelin/contracts OpenZeppelin Contracts Bytes's LastIndexOf Function Vulnerability
MODERATECVE-2025-54070 is a MODERATE (CVSS 0.0) openzeppelin contracts bytes's lastindexof function vulnerability (CWE-125: Out-of-bounds Read) affecting @openzeppelin/contracts libraries in the npm ecosystem. The issue involves openzeppelin contracts bytes's lastindexof function with position argument performs out-of-bound memory access on empty buffers. Remediation is available by upgrading affected packages to version 5.4.0.
CVE-2025-54070 at a Glance
Security Impact
CVSS: 0.0
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N).
How to Fix CVE-2025-54070
To remediate this vulnerability, upgrade all affected @openzeppelin/contracts dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @openzeppelin/contracts@5.4.0npm install @openzeppelin/contracts-upgradeable@5.4.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @openzeppelin/contractsHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2025-54070, inspect your project dependencies using npm:
npm ls @openzeppelin/contractsAnalyze the terminal output to locate any version of @openzeppelin/contracts in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.4.0), your application is affected.
Note: The npm ls @openzeppelin/contracts command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-125: Out-of-bounds Read, where the product reads data past the end, or before the beginning, of the intended buffer. In @openzeppelin/contracts, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-54070 Affected @openzeppelin/contracts Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@openzeppelin/contracts
|
npm |
≥ 5.2.0
< 5.4.0
|
5.4.0
|
|
@openzeppelin/contracts-upgradeable
|
npm |
≥ 5.2.0
< 5.4.0
|
5.4.0
|
References
Frequently Asked Questions
What is CVE-2025-54070?
Which @openzeppelin/contracts versions are affected?
What version fixes CVE-2025-54070?
Is @openzeppelin/contracts affected?
Is @openzeppelin/contracts-upgradeable affected?
What is the CVSS score of CVE-2025-54070?
What CWE is associated with CVE-2025-54070?
How can I check npm dependencies for CVE-2025-54070?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-9rcw-c2f9-2j55",
"modified" : "2025-07-17T22:06:46Z",
"published" : "2025-07-17T21:19:32Z",
"aliases" : [ "CVE-2025-54070" ],
"summary" : "OpenZeppelin Contracts Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers",
"details" : "### Impact\n\nThe `lastIndexOf(bytes,byte,uint256)` function of the `Bytes.sol` library may access uninitialized memory when the following two conditions hold: 1) the provided buffer length is empty (i.e. `buffer.length == 0`) and position is not `2**256 - 1` (i.e. `pos != type(uint256).max`).\n\nThe `pos` argument could be used to access arbitrary data outside of the buffer bounds. This could lead to the operation running out of gas, or returning an invalid index (outside of the empty buffer). Processing this invalid result for accessing the `buffer` would cause a revert under normal conditions.\n\nWhen triggered, the function reads memory at offset `buffer + 0x20 + pos`. If memory at that location (outside the `buffer`) matches the search pattern, the function would return an out of bound index instead of the expected `type(uint256).max`. This creates unexpected behavior where callers receive a valid-looking index pointing outside buffer bounds.\n\nSubsequent memory accesses that don't check bounds and use the returned index must carefully review the potential impact depending on their setup. Code relying on this function returning `type(uint256).max` for empty buffers or using the returned index without bounds checking could exhibit undefined behavior.\n\n### Patches\n\nUpgrade to 5.4.0",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@openzeppelin/contracts"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "5.2.0"
}, {
"fixed" : "5.4.0"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "@openzeppelin/contracts-upgradeable"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "5.2.0"
}, {
"fixed" : "5.4.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9rcw-c2f9-2j55"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-54070"
}, {
"type" : "WEB",
"url" : "https://github.com/OpenZeppelin/openzeppelin-contracts/pull/5797"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/OpenZeppelin/openzeppelin-contracts"
}, {
"type" : "WEB",
"url" : "https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v5.4.0"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-125" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2025-07-17T21:19:32Z",
"nvd_published_at" : "2025-07-17T19:15:25Z"
}
}