HIGH7.5npm
GHSA-4g63-c64m-25w9· CVE-2022-31172OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers
Modified: 11/8/2023
package
npm/@openzeppelin/contracts-upgradeable
pkg:npm/%40openzeppelin/contracts-upgradeable
HIGH7.9npm
GHSA-4h98-2769-gh6h· CVE-2022-35961OpenZeppelin Contracts vulnerable to ECDSA signature malleability
Modified: 11/8/2023
MEDIUM5.3npm
GHSA-5h3x-9wvq-w4m2· CVE-2023-34234OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning
Modified: 9/10/2026
CRITICAL9.8npm
GHSA-5vp3-v4hc-gx76· CVE-2021-41264UUPSUpgradeable vulnerability in @openzeppelin/contracts
Modified: 7/8/2026
MEDIUM5.9npm
GHSA-699g-q6qh-q4v8· CVE-2023-49798OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4
Modified: 9/10/2026
MEDIUM5.3npm
GHSA-7grf-83vw-6f5x· CVE-2022-35915OpenZeppelin Contracts ERC165Checker unbounded gas consumption
Modified: 11/8/2023
LOWnpm
GHSA-7j52-6fjp-58grInconsistent storage layout for ERC2771ContextUpgradeable
Modified: 3/14/2022
MEDIUM6.5npm
GHSA-878m-3g6q-594q· CVE-2023-26488OpenZeppelin Contracts contains Incorrect Calculation
Modified: 11/8/2023
HIGH8.8npm
GHSA-93hq-5wgc-jc82· CVE-2023-30542GovernorCompatibilityBravo may trim proposal calldata
Modified: 11/8/2023
MEDIUM5.6npm
GHSA-9c22-pwxw-p6hx· CVE-2021-46320, CVE-2022-39384OpenZeppelin Contracts initializer reentrancy may lead to double initialization
Modified: 7/16/2026
MEDIUM5.3npm
GHSA-9j3m-g383-29qr· CVE-2022-35916OpenZeppelin Contracts's Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls
Modified: 11/8/2023
—0.0npm
GHSA-9rcw-c2f9-2j55· CVE-2025-54070OpenZeppelin Contracts Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers
Modified: 7/17/2025
MEDIUM6.5npm
GHSA-9vx6-7xxf-x967· CVE-2024-27094OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
Modified: 12/5/2025
MEDIUM5.3npm
GHSA-g4vp-m682-qqmp· CVE-2023-40014OpenZeppelin Contracts vulnerable to Improper Escaping of Output
Modified: 11/8/2023
MEDIUMnpm
GHSA-m6w8-fq7v-ph4mGovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior
Modified: 1/12/2022
MEDIUM5.3npm
GHSA-mx2q-35m2-x2rh· CVE-2023-30541OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegated
Modified: 9/10/2026
CRITICALnpm
GHSA-q4h9-46xg-m3x9UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable
Modified: 9/14/2021
HIGH7.5npm
GHSA-qh9x-gcfh-pcrw· CVE-2022-31170OpenZeppelin Contracts's ERC165Checker may revert instead of returning false
Modified: 11/8/2023
CRITICAL10.0npm
GHSA-vrw4-w73r-6mm8· CVE-2021-39168TimelockController vulnerability in OpenZeppelin Contracts
Modified: 7/8/2026
LOWnpm
GHSA-wmpv-c2jp-j2xgERC1155Supply vulnerability in OpenZeppelin Contracts
Modified: 11/15/2021
MEDIUM5.3npm
GHSA-wprv-93r4-jj2p· CVE-2023-34459OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific trees
Modified: 9/10/2026
HIGH7.5npm
GHSA-xrc4-737v-9q75· CVE-2022-31198OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals
Modified: 11/8/2023