CVE-2020-7765: Uncontrolled Resource Consumption in @firebase/util
Summary
CVE-2020-7765: Uncontrolled Resource Consumption in firebase. Affects @firebase/util versions < 0.3.4. Fixed in 0.3.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @firebase/util package is an npm package that provides utility functions for Firebase projects. It is commonly used to handle various tasks such as deep copying objects, managing resources, and extending object prototypes. This package is vulnerable to an uncontrolled resource consumption issue in the deepExtend function within the DeepCopy.ts file. If user input is not properly validated, an attacker can manipulate the object prototype and potentially cause resource exhaustion.
Vulnerability Detail
The vulnerability (CVE-2020-7765) in @firebase/util allows an attacker to overwrite and pollute the object prototype, leading to uncontrolled resource consumption. By providing malicious input, an attacker can exploit this vulnerability to exhaust system resources, potentially causing denial-of-service (DoS) conditions. The deepExtend function in the DeepCopy.ts file is the specific entry point for this vulnerability. It is important to note that this vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 1.15.3 as of 22 Oct 2026
npm install @firebase/util@1.15.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.4
This is the first release that contains the fix.
npm install @firebase/util@0.3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization to ensure that user input is properly validated before being used in the deepExtend function. By validating and sanitizing user input, the risk of exploitation can be mitigated. Here is an example of how input validation can be implemented in JavaScript:
const deepExtend = require('@firebase/util').deepExtend;
function validateInput(input) {
// Perform input validation and sanitization
// ...
return input;
}
const sanitizedInput = validateInput(userInput);
const result = deepExtend({}, sanitizedInput);
Conclusion
In conclusion, the @firebase/util package is vulnerable to uncontrolled resource consumption, which can be exploited by an attacker to manipulate the object prototype and cause resource exhaustion. To mitigate this vulnerability, it is crucial to upgrade to version 0.3.4 or later of the package. Additionally, implementing input validation and sanitization can provide temporary protection. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @firebase/util →
FAQ
This vulnerability allows an attacker to consume excessive system resources, potentially leading to denial-of-service (DoS) conditions. It can impact the availability and performance of the affected application or system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. The Vulert Playground analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities, including this one.
Yes, a fix is available for this vulnerability. It is recommended to upgrade the @firebase/util package to version 0.3.4 or later to mitigate the uncontrolled resource consumption issue.
As a temporary workaround, you can implement input validation and sanitization to ensure that user input is properly validated before being used in the deepExtend function. This can help mitigate the risk of exploitation.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-fpm5-vv97-jfwg/GHSA-fpm5-vv97-jfwg.json).
