UUPSUpgradeable Vulnerability in @openzeppelin/contracts-upgradeable
Summary
GHSA-q4h9-46xg-m3x9: UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable. Affects @openzeppelin/contracts-upgradeable versions >= 4.1.0, < 4.3.2. Fixed in 4.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @openzeppelin/contracts-upgradeable package is an open-source library for building upgradeable smart contracts on the Ethereum blockchain. It provides a set of secure and audited contracts that can be easily upgraded without losing state or disrupting the functionality of deployed contracts. The UUPSUpgradeable contract is a key component of this library, allowing for seamless upgrades of implementation contracts. However, a vulnerability has been discovered in the UUPSUpgradeable contract that could lead to uninitialized implementation contracts.
Vulnerability Detail
The UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable affects upgradeable contracts that use the UUPSUpgradeable contract. The vulnerability allows uninitialized implementation contracts to be exploited, potentially leading to unauthorized access, manipulation of contract state, or other malicious activities. The exact details of the vulnerability have not been disclosed at this time, but the OpenZeppelin team has released a fix in version 4.3.2 of the @openzeppelin/contracts and @openzeppelin/contracts-upgradeable packages.
How To Fix
Latest published version: 5.6.1 as of 22 Oct 2026
npm install @openzeppelin/contracts-upgradeable@5.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.3.2
This is the first release that contains the fix.
npm install @openzeppelin/contracts-upgradeable@4.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the packages is not immediately feasible, a workaround is available. Implementation contracts using UUPSUpgradeable should be initialized by invoking the initializer function, typically named 'initialize'. This ensures that the implementation contract is properly initialized and mitigates the vulnerability. Here is an example of how to initialize an implementation contract using UUPSUpgradeable:
contract MyContract is UUPSUpgradeable {
function initialize() public initializer {
// Initialization code here
}
}
Conclusion
The UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable can be mitigated by updating the packages to version 4.3.2 or later. Alternatively, implementation contracts can be initialized using the workaround provided. It is important to take action to address this vulnerability and ensure the security of your smart contracts.
See every vulnerability recorded for @openzeppelin/contracts-upgradeable →
FAQ
The vulnerability allows uninitialized implementation contracts to be exploited, potentially leading to unauthorized access, manipulation of contract state, or other malicious activities.
To fix the vulnerability, update the @openzeppelin/contracts and @openzeppelin/contracts-upgradeable packages to version 4.3.2 or later.
Yes, a workaround is available. Initialize implementation contracts using UUPSUpgradeable by invoking the initializer function.
A post-mortem will be published in a few days on the OpenZeppelin Forum.
For assistance with mitigating this vulnerability, you can email security@openzeppelin.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for @openzeppelin/contracts-upgradeable.
