PatchTheCVEweb3js vulnerabilities
Recent CVEs affecting web3js products. 2 tracked.
web3js has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2025-09-24. Highest priority: CVE-2025-57330 (score 40/100).
- CVE-2025-57330 HIGH 7.5 UPGRADE The web3-core-subscriptions is a package designed to manages web3 subscriptions
- CVE-2025-57329 HIGH 7.5 UPGRADE web3-core-method is a package designed to creates the methods on the web3 modules
FAQ
How do I fix web3js vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is web3js being exploited right now?
None of the tracked web3js CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which web3js CVE should I patch first?
CVE-2025-57330 currently ranks highest (40/100): The web3-core-subscriptions is a package designed to manages web3 subscriptions.