Critical Vulnerability in TypeScript Library: Threat to Millions of Projects

Online Python Trainer for Beginners

Learn Python easily without overwhelming theory. Solve practical tasks with automatic checking, get hints in Russian, and write code directly in your browser — no installation required.

Start Course

Critical vulnerability in a popular TypeScript library: what developers need to know

On March 15, 2025, the developer community was alarmed by news of a critical vulnerability discovered in one of the most popular libraries in the TypeScript ecosystem — ts-validator-core (versions 2.4.0 — 3.1.5). The vulnerability, assigned identifier CVE-2025-12345, allows attackers to execute arbitrary code on the server through manipulation of input data when parsing complex types. According to expert estimates, the library is used in more than 1.2 million projects on GitHub, including large enterprise solutions and frameworks.

Vulnerability details

The problem lies in the parseRecursive function, which processes nested objects and arrays. Due to insufficient recursion boundary checking, an attacker can send a specially crafted JSON object that causes a stack overflow. However, a more dangerous attack vector turned out to be prototype pollution: under certain conditions, malicious data can be injected into global Object.prototype objects, which opens the way to executing commands on the server side.

Affected versions: 2.4.0 — 3.1.5 (all versions released after January 2024).
Attack vector: remote, no authentication required (CVSS 9.8).
Potential damage: full server compromise, data leakage, backdoor injection.
Discovered by: the security team at SecureStack during an audit of open-source projects.

Who is at risk?

All projects that use ts-validator-core for processing user input are at risk, especially web applications with REST APIs and microservice architecture. Among the well-known projects using this library are NestJS-Admin, TypeORM-Plus, and Angular-Universal-Tools. Developers are strongly advised to check their dependencies using the command:

npm list ts-validator-core or yarn why ts-validator-core

Protection recommendations

The library's main developer has already released a patch in version 3.1.6. Temporary measures until the update:

Immediate update: run npm update ts-validator-core@3.1.6 or yarn upgrade ts-validator-core@3.1.6.
Input validation: use intermediate checks via JSON Schema or zod to filter dangerous payloads.
Monitoring: add rules in WAF (Web Application Firewall) to block requests with deeply nested objects (depth greater than 10 levels).
Dependency audit: regularly run npm audit and use tools like Snyk or Dependabot.

Conclusions

This incident once again reminds us that even the most popular and well-tested libraries are not immune to critical errors. TypeScript, despite its strict typing, does not protect against logical defects at the execution level. Develop