CVE-2020-5232: Malicious takeover of previously owned ENS names in @ensdomains/ens
Summary
CVE-2020-5232: Malicious takeover of previously owned ENS names. Affects @ensdomains/ens versions < 0.4.0. Fixed in 0.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @ensdomains/ens package is an npm package that is part of the Ethereum Name Service (ENS) system. ENS is a decentralized domain name system built on the Ethereum blockchain. It allows users to register and manage domain names ending in .eth. The @ensdomains/ens package provides the functionality to interact with the ENS registry and perform operations such as registering, transferring, and managing domain names.
Vulnerability Detail
This vulnerability allows a user who owns an ENS domain to set a "trapdoor" that enables them to transfer ownership to another user and later regain ownership without the new owner's consent or awareness. This can lead to unauthorized control over ENS domains and potential misuse of the associated services. The vulnerability is due to a flaw in the ENS registry implementation.
How To Fix
Latest published version: 0.6.2 as of 23 Oct 2026
npm install @ensdomains/ens@0.6.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.0
This is the first release that contains the fix.
npm install @ensdomains/ens@0.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users should avoid accepting transfers of ENS domains from other users on the old registrar. This can help mitigate the risk of falling victim to the malicious takeover.
Conclusion
The @ensdomains/ens package is vulnerable to a malicious takeover of previously owned ENS names. To mitigate this vulnerability, users should update to the fixed version of the package and avoid accepting transfers from other users on the old registrar. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @ensdomains/ens →
FAQ
ENS stands for Ethereum Name Service. It is a decentralized domain name system built on the Ethereum blockchain.
The vulnerability allows a user to transfer ownership of an ENS domain to another user without their consent or awareness, potentially leading to unauthorized control over the domain.
To fix this vulnerability, update the @ensdomains/ens package to version 0.4.0 and ensure that you are using the new ENS registry deployed at address 0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e.
Yes, you can mitigate the risk by avoiding accepting transfers of ENS domains from other users on the old registrar.
You can find more information about ENS on the official ENS website. For specific details about this vulnerability, refer to the GitHub advisory linked in the vulnerability details.
