CVE-2024-57083: Redocly Redoc DoS Vulnerability

CVE-2024-57083 Overview

CVE-2024-57083 is a prototype pollution vulnerability in Redocly Redoc versions 2.2.0 and earlier. The flaw resides in the Module.mergeObjects function located at redoc/bundles/redoc.lib.js:2. Attackers can supply a crafted payload to pollute the JavaScript object prototype chain. Successful exploitation results in a Denial of Service (DoS) condition affecting applications that render OpenAPI documentation using Redoc.

The vulnerability is classified under [CWE-1321] (Improperly Controlled Modification of Object Prototype Attributes). It requires no authentication or user interaction and can be triggered remotely over the network.

Critical Impact
Remote attackers can crash Redoc-powered documentation services through a single crafted payload, disrupting API documentation availability for downstream consumers.

Affected Products

Redocly Redoc versions <= 2.2.0
Applications embedding the vulnerable redoc.lib.js bundle
OpenAPI documentation portals built on top of Redoc

Discovery Timeline

2025-03-28 - CVE-2024-57083 published to NVD
2025-04-14 - Last updated in NVD database

Technical Details for CVE-2024-57083

Vulnerability Analysis

The vulnerability stems from unsafe object merging logic inside Redoc's Module.mergeObjects function. The function recursively copies properties from a source object into a target object without filtering dangerous keys such as __proto__, constructor, or prototype. When an attacker controls the source object, properties can be written to Object.prototype, altering the behavior of every object in the JavaScript runtime.

This class of flaw, prototype pollution [CWE-1321], poisons shared prototype chains in Node.js or browser environments running Redoc. The resulting state corruption causes runtime exceptions when the application later accesses polluted properties. The end result is a Denial of Service against the documentation rendering pipeline.

Redoc is widely embedded in developer portals and CI pipelines that publish OpenAPI specifications. Any service that ingests untrusted OpenAPI definitions through the vulnerable merge routine inherits the risk.

Root Cause

The mergeObjects helper does not validate property keys before assignment. Recursive merges descend into nested objects supplied by an attacker, and assignment to __proto__.<key> writes onto the global prototype rather than the target instance. The library does not use Object.create(null), hasOwnProperty checks, or key allowlists to neutralize this behavior.

Attack Vector

An attacker delivers a JSON or JavaScript object containing a __proto__ key with attacker-chosen sub-properties. When Redoc parses this object through mergeObjects, the malicious keys overwrite or inject properties on Object.prototype. Subsequent code paths that read those properties trigger type errors, infinite loops, or unhandled exceptions, terminating the rendering process.

The vulnerability is detailed in the Redoc GitHub Issue Discussion. No public proof-of-concept exploit is currently listed in Exploit-DB.

Detection Methods for CVE-2024-57083

Indicators of Compromise

Inbound HTTP requests or OpenAPI documents containing the literal strings __proto__, constructor.prototype, or prototype inside JSON payloads.
Repeated crashes, restarts, or unhandled exception logs from services that load redoc.lib.js.
Unexpected enumerable properties appearing on objects across the Redoc runtime.

Detection Strategies

Inspect application dependency manifests for redoc package versions at or below 2.2.0.
Apply web application firewall rules that flag JSON bodies containing prototype-related keys destined for documentation endpoints.
Review server logs for stack traces originating in redoc.lib.js around the mergeObjects symbol.

Monitoring Recommendations

Monitor process availability and restart counts for any service that renders OpenAPI specifications with Redoc.
Alert on HTTP 5xx response spikes from documentation hosts following ingestion of new specification files.
Track Software Bill of Materials (SBOM) data continuously to surface newly introduced vulnerable Redoc versions in build pipelines.

How to Mitigate CVE-2024-57083

Immediate Actions Required

Identify all deployments shipping redoc 2.2.0 or earlier and prioritize them for upgrade.
Restrict who can submit OpenAPI specifications to Redoc-backed portals to authenticated, trusted producers.
Validate or sanitize OpenAPI inputs to strip __proto__, constructor, and prototype keys before they reach the renderer.

Patch Information

Refer to the upstream Redoc GitHub Issue Discussion for remediation status. Upgrade Redoc to a version released after 2.2.0 that addresses the unsafe merge behavior, and rebuild any bundled distributions that embed redoc.lib.js.

Workarounds

Front the documentation service with a reverse proxy that rejects payloads containing prototype-pollution markers.
Run Redoc in an isolated process with automatic restart so that a successful DoS does not affect adjacent services.
Pre-process OpenAPI documents through a hardened parser that uses Object.create(null) for intermediate objects before passing data to Redoc.

bash

# Example: block prototype-pollution markers at an Nginx reverse proxy
location /docs/ {
    if ($request_body ~* "(__proto__|constructor\\.prototype|\"prototype\":)") {
        return 400;
    }
    proxy_pass http://redoc_backend;
}