{"id":"GHSA-9c22-pwxw-p6hx","summary":"OpenZeppelin Contracts initializer reentrancy may lead to double initialization","details":"### Impact\n\nInitializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call.\n\nOnce an initializer has finished running it can never be re-executed. However, an exception put in place to support multiple inheritance made reentrancy possible in the scenario described above, breaking the expectation that there is a single execution.\n\nNote that upgradeable proxies are commonly initialized together with contract creation, where reentrancy is not feasible, so the impact of this issue is believed to be minor.\n\n### Patches\n\nA fix is included in the version v4.4.1 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.\n\n### Workarounds\n\nAvoid untrusted external calls during initialization.\n\n### References\nhttps://github.com/OpenZeppelin/openzeppelin-contracts/pull/3006\n\n### Credits\n\nThis issue was identified and reported by @chaitinblockchain through [our bug bounty on Immunefi](https://immunefi.com/bounty/openzeppelin/).\n\n### For more information\n\nIf you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.\n","aliases":["CVE-2021-46320","CVE-2022-39384","GHSA-88g8-f5mf-f5rj"],"modified":"2026-07-16T03:59:27.534685008Z","published":"2021-12-14T21:47:33Z","database_specific":{"github_reviewed_at":"2021-12-14T19:22:45Z","nvd_published_at":"2022-11-04T22:15:00Z","cwe_ids":["CWE-665"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9c22-pwxw-p6hx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39384"},{"type":"WEB","url":"https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3006"},{"type":"PACKAGE","url":"https://github.com/OpenZeppelin/openzeppelin-contracts"}],"affected":[{"package":{"name":"@openzeppelin/contracts","ecosystem":"npm","purl":"pkg:npm/%40openzeppelin/contracts"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.2.0"},{"fixed":"4.4.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-9c22-pwxw-p6hx/GHSA-9c22-pwxw-p6hx.json"}},{"package":{"name":"@openzeppelin/contracts-upgradeable","ecosystem":"npm","purl":"pkg:npm/%40openzeppelin/contracts-upgradeable"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.2.0"},{"fixed":"4.4.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-9c22-pwxw-p6hx/GHSA-9c22-pwxw-p6hx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}