LIBRARY SECURITY
This page lists the 24 GitHub advisory ids for @openzeppelin/contracts and @openzeppelin/contracts-upgradeable, from the 2021 TimelockController advisory to the 2025 lastIndexOf memory-access bug. The two OpenZeppelin repositories published 23 of them. GitHub added GHSA-88g8-f5mf-f5rj. The page counts the advisories per stable npm release, and the lookup shows the advisories for your version.
On this page Version lookup All advisories Duplicates All versions By major line Support status Method
Ranges and severities below are read from the global GitHub Advisory Database on 2026-10-29. Where the repository advisory gives a different severity, both are shown. Every count on this page and the worst severity in the lookup use the GitHub database rating.
The lookup covers only @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. GHSA-7grf-83vw-6f5x also names the legacy packages openzeppelin-solidity and openzeppelin-eth, which have no patched version.
| Published (GitHub database) | Advisory | Title, package | Severity (GitHub database; repository if different) | First patched |
|---|---|---|---|---|
| 2025-07-17 | GHSA-9rcw-c2f9-2j55 | OpenZeppelin Contracts Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty bufferscontracts, contracts-upgradeable | medium (repo: low) | 5.4.0 |
| 2024-02-29 | GHSA-9vx6-7xxf-x967 | OpenZeppelin Contracts base64 encoding may read from potentially dirty memorycontracts, contracts-upgradeable | medium (repo: low) | 4.9.6, 5.0.2 |
| 2023-12-12 | GHSA-699g-q6qh-q4v8 | OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4contracts, contracts-upgradeable | medium | 4.9.5 |
| 2023-08-11 | GHSA-g4vp-m682-qqmp | OpenZeppelin Contracts vulnerable to Improper Escaping of Outputcontracts, contracts-upgradeable | medium (repo: low) | 4.9.3 |
| 2023-06-19 | GHSA-wprv-93r4-jj2p | OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific treescontracts, contracts-upgradeable | medium | 4.9.2 |
| 2023-06-08 | GHSA-5h3x-9wvq-w4m2 | OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunningcontracts, contracts-upgradeable | medium | 4.9.1 |
| 2023-04-20 | GHSA-93hq-5wgc-jc82 | GovernorCompatibilityBravo may trim proposal calldatacontracts, contracts-upgradeable | high (repo: medium) | 4.8.3 |
| 2023-04-17 | GHSA-mx2q-35m2-x2rh | OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegatedcontracts, contracts-upgradeable | medium (repo: low) | 4.8.3 |
| 2023-03-03 | GHSA-878m-3g6q-594q | OpenZeppelin Contracts contains Incorrect Calculationcontracts, contracts-upgradeable | medium | 4.8.2 |
| 2022-08-18 | GHSA-xrc4-737v-9q75 | OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposalscontracts, contracts-upgradeable | high | 4.7.2 |
| 2022-08-18 | GHSA-4h98-2769-gh6h | OpenZeppelin Contracts vulnerable to ECDSA signature malleabilitycontracts, contracts-upgradeable | high | 4.7.3 |
| 2022-08-14 | GHSA-9j3m-g383-29qr | OpenZeppelin Contracts's Cross chain utilities for Arbitrum L2 see EOA calls as cross chain callscontracts, contracts-upgradeable | medium (repo: low) | 4.7.2 |
| 2022-08-14 | GHSA-7grf-83vw-6f5x | OpenZeppelin Contracts ERC165Checker unbounded gas consumptioncontracts, contracts-upgradeable, openzeppelin-eth, openzeppelin-solidity | medium | 4.7.2 |
| 2022-07-21 | GHSA-qh9x-gcfh-pcrw | OpenZeppelin Contracts's ERC165Checker may revert instead of returning falsecontracts, contracts-upgradeable | high | 4.7.1 |
| 2022-07-21 | GHSA-4g63-c64m-25w9 | OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signerscontracts, contracts-upgradeable | high (repo: medium) | 4.7.1 |
| 2022-03-14 | GHSA-7j52-6fjp-58gr | Inconsistent storage layout for ERC2771ContextUpgradeablecontracts-upgradeable | low | 4.3.0 |
| 2022-02-05 | GHSA-88g8-f5mf-f5rj | Improper Initialization in OpenZeppelincontracts | high (no repository advisory) | 4.4.1 |
| 2022-01-13 | GHSA-m6w8-fq7v-ph4m | GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behaviorcontracts, contracts-upgradeable | medium | 4.4.2 |
| 2021-12-14 | GHSA-9c22-pwxw-p6hx | OpenZeppelin Contracts initializer reentrancy may lead to double initializationcontracts, contracts-upgradeable | medium (repo: low) | 4.4.1 |
| 2021-11-15 | GHSA-wmpv-c2jp-j2xg | ERC1155Supply vulnerability in OpenZeppelin Contractscontracts, contracts-upgradeable | low | 4.3.3 |
| 2021-09-15 | GHSA-q4h9-46xg-m3x9 | UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeablecontracts-upgradeable | critical | 4.3.2 |
| 2021-09-15 | GHSA-5vp3-v4hc-gx76 | UUPSUpgradeable vulnerability in @openzeppelin/contractscontracts, contracts-upgradeable | critical | 4.3.2 |
| 2021-08-30 | GHSA-vrw4-w73r-6mm8 | TimelockController vulnerability in OpenZeppelin Contractscontracts-upgradeable | critical | 3.4.2, 4.3.1 |
| 2021-08-30 | GHSA-fg47-3c2x-m2wr | TimelockController vulnerability in OpenZeppelin Contracts contracts | critical | 3.4.2, 4.3.1 |
Three issues have two GHSA ids each. GHSA-88g8-f5mf-f5rj is a GitHub-reviewed entry for the issue of GHSA-9c22-pwxw-p6hx; OSV lists CVE-2021-46320 and CVE-2022-39384 as aliases of both. The TimelockController and UUPSUpgradeable issues have one advisory in each OpenZeppelin repository. The other 18 ids are one issue each.
| Issue | Advisories |
|---|---|
| Initializer reentrancy (CVE-2021-46320) | GHSA-9c22-pwxw-p6hx and GHSA-88g8-f5mf-f5rj |
| TimelockController (CVE-2021-39167, CVE-2021-39168) | GHSA-fg47-3c2x-m2wr and GHSA-vrw4-w73r-6mm8 |
| UUPSUpgradeable (CVE-2021-41264; GHSA-q4h9-46xg-m3x9 has no CVE) | GHSA-5vp3-v4hc-gx76 and GHSA-q4h9-46xg-m3x9 |
24 GHSA ids are 21 distinct issues. The advisory table and the version table count ids; the major-line table counts issues.
contracts-upgradeable has 45 stable releases. Its releases 4.5.1 and 4.5.2 are not in this table. Use the lookup for them.
Counts use the global database ranges for @openzeppelin/contracts only. Use the lookup for @openzeppelin/contracts-upgradeable. The severity columns use the GitHub database rating.
| Version | Advisory ids | Critical or high (GitHub) | Medium (GitHub) | Low (GitHub) |
|---|---|---|---|---|
| 5.7.0 (newest release, npm dist-tag dev; dist-tag latest is 5.6.1) | 0 | 0 | 0 | 0 |
| 5.6.1 | 0 | 0 | 0 | 0 |
| 5.6.0 | 0 | 0 | 0 | 0 |
| 5.5.0 | 0 | 0 | 0 | 0 |
| 5.4.0 | 0 | 0 | 0 | 0 |
| 5.3.0 | 1 | 0 | 1 | 0 |
| 5.2.0 | 1 | 0 | 1 | 0 |
| 5.1.0 | 0 | 0 | 0 | 0 |
| 5.0.2 | 0 | 0 | 0 | 0 |
| 5.0.1 | 1 | 0 | 1 | 0 |
| 5.0.0 | 1 | 0 | 1 | 0 |
| 4.9.6 | 0 | 0 | 0 | 0 |
| 4.9.5 | 1 | 0 | 1 | 0 |
| 4.9.4 deprecated on npm | 2 | 0 | 2 | 0 |
| 4.9.3 | 1 | 0 | 1 | 0 |
| 4.9.2 | 2 | 0 | 2 | 0 |
| 4.9.1 | 3 | 0 | 3 | 0 |
| 4.9.0 | 4 | 0 | 4 | 0 |
| 4.8.3 | 4 | 0 | 4 | 0 |
| 4.8.2 | 6 | 1 | 5 | 0 |
| 4.8.1 | 7 | 1 | 6 | 0 |
| 4.8.0 | 7 | 1 | 6 | 0 |
| 4.7.3 | 6 | 1 | 5 | 0 |
| 4.7.2 | 7 | 2 | 5 | 0 |
| 4.7.1 | 10 | 3 | 7 | 0 |
| 4.7.0 | 12 | 5 | 7 | 0 |
| 4.6.0 | 11 | 5 | 6 | 0 |
| 4.5.0 | 10 | 5 | 5 | 0 |
| 4.4.2 | 9 | 5 | 4 | 0 |
| 4.4.1 | 10 | 5 | 5 | 0 |
| 4.4.0 | 12 | 6 | 6 | 0 |
| 4.3.3 | 12 | 6 | 6 | 0 |
| 4.3.2 | 13 | 6 | 6 | 1 |
| 4.3.1 | 14 | 7 | 6 | 1 |
| 4.3.0 | 15 | 8 | 6 | 1 |
| 4.2.0 | 11 | 6 | 4 | 1 |
| 4.1.0 | 10 | 6 | 4 | 0 |
| 4.0.0 | 7 | 3 | 4 | 0 |
| 3.4.2 | 4 | 1 | 3 | 0 |
| 3.4.1 | 5 | 2 | 3 | 0 |
| 3.4.0 | 5 | 2 | 3 | 0 |
| 3.3.0 | 5 | 2 | 3 | 0 |
| 3.2.0 | 4 | 1 | 3 | 0 |
| 3.1.0 | 2 | 1 | 1 | 0 |
| 3.0.2 | 2 | 1 | 1 | 0 |
| 3.0.1 | 2 | 1 | 1 | 0 |
| 3.0.0 | 2 | 1 | 1 | 0 |
| 2.5.1 | 2 | 1 | 1 | 0 |
| 2.5.0 | 2 | 1 | 1 | 0 |
| 2.4.0 | 2 | 1 | 1 | 0 |
| 2.3.0 | 2 | 1 | 1 | 0 |
Distinct issues per major line. An issue counts once in a line when its range covers at least one stable npm release of that line. Each duplicate pair counts as one issue. 4.x carries the bulk of the history: it lived through the 2021 to 2023 advisory cluster.
| Package | 2.x | 3.x | 4.x | 5.x |
|---|---|---|---|---|
| @openzeppelin/contracts | 2 | 4 | 19 | 2 |
| @openzeppelin/contracts-upgradeable | no release | 4 | 20 | 2 |
The project's own security policy says, quoting:
Security patches will be released for the latest minor of a given major release. For example, if an issue is found in versions >=4.6.0 and the latest is 4.8.0, the patch will be released only in version 4.8.1.
Only critical severity bug fixes will be backported to past major releases.
Supported lines, quoted from the same policy (5.x gets all security fixes; 4.9 and 3.4 get critical fixes only; 2.5 and versions below 2.0 get none):
| Version | Critical security fixes | Other security fixes |
|---|---|---|
| 5.x | yes | yes |
| 4.9 | yes | no |
| 3.4 | yes | no |
| 2.5 | no | no |
| < 2.0 | no | no |
If you are on 4.9.x or 3.4.x, the policy promises only critical fixes. Two non-critical fixes still reached 4.9.x after 5.0.0 (released 2023-10-05): 4.9.5 for GHSA-699g-q6qh-q4v8 and 4.9.6 for GHSA-9vx6-7xxf-x967. The policy does not promise more.
One critical TimelockController issue has two ids in the GitHub database: GHSA-fg47-3c2x-m2wr for contracts and GHSA-vrw4-w73r-6mm8 for contracts-upgradeable. In both packages it affects the stable releases 4.0.0 to 4.3.0 and 3.3.0 to 3.4.1. The TimelockController advisory (CVE-2021-39167) says, quoting:
Deployed instances of TimelockController should be replaced with a fixed version by migrating all assets, ownership, and roles.
Replacing a deployed contract is not an npm update. The workaround of the advisory, quoting: "Revoke the executor role from accounts not strictly under the team's control."
The 4.9.4 advisory (CVE-2023-49798, duplicated delegatecall in Multicall) says, quoting:
The duplicated delegatecall was removed in 4.9.5. The 4.9.4 version is marked as deprecated.
npm confirms: both @openzeppelin/contracts@4.9.4 and @openzeppelin/contracts-upgradeable@4.9.4 carry an npm deprecation notice. If your lockfile pins 4.9.4, move to 4.9.6. Version 4.9.5 is still in the range of GHSA-9vx6-7xxf-x967.
The Base64 advisory (CVE-2024-27094) patches two branches at once. Its fix line, quoting:
Upgrade to 5.0.2 or 4.9.6.
The policy promises backports to past majors only for critical fixes. This advisory is low in the repository and medium in the GitHub database. This fix was also backported to 4.9.6.
Fetched 2026-10-29 with the GitHub API: the advisories of both repositories
(repos/OpenZeppelin/openzeppelin-contracts/security-advisories and repos/OpenZeppelin/openzeppelin-contracts-upgradeable/security-advisories), the global GitHub Advisory
Database entries for both packages (advisories?ecosystem=npm&affects=@openzeppelin/contracts and the same query for @openzeppelin/contracts-upgradeable). Also fetched: the npm
registry metadata for both packages (versions, dist-tags and deprecation notices), the
project's SECURITY.md, and the OSV record of each of the 24 ids (api.osv.dev/v1/vulns/<id>), which gives the CVE aliases in the duplicate section. The lookup and the tables use global-database ranges; where the repository advisory
disagrees on severity, the advisory table shows the global rating and names the repository rating next to it.
First-patched versions come from the advisory's first_patched_version field. Data fetched 2026-10-29 at 07:30 UTC. A second fetch at 10:33 UTC gave the same ids, severities, ranges, stable versions and npm dist-tags.
Counts in the version table are advisory ids whose published range for @openzeppelin/contracts covers the version, computed from the global database ranges in the fetched files. The major-line table counts issues per package, as its note says. npm also lists 53 pre-releases and solc-0.7 builds of @openzeppelin/contracts and 35 of @openzeppelin/contracts-upgradeable (rc and beta tags, and builds named like 3.4.2-solc-0.7). The tables and the lookup do not count them; only stable npm releases are counted.
Related: Solidity compiler bugs by version, Vyper compiler bugs by version.