Intel

AIKIDO-2025-10051

@mantine/dates is vulnerable to Unlimited Resource Consumption

Unlimited Resource Consumption Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Jan 27, 2025

45

Medium Risk

This Affects:

JS@mantine/dates
5.9.6 - 7.16.1
Fixed in 7.16.2
Are you affected? Scan for Free

TL;DR

Affected versions of this package are affected by unlimited resource consumption in a form date handler that can cause infinite useEffect loops due to improper dependency handling or state updates during render. It may degrade performance, crash the app, or block user interactions. An attacker could exploit this by crafting a malicious form to trigger the loop, leading to excessive resource use and potential denial of service.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

@mantine/dates is vulnerable to Unlimited Resource Consumption in versions 5.9.6 - 7.16.1.

How to fix this

Upgrade the @mantine/dates library to the patch version.