Read the docs
TI-2024-27967 Aliases CVE-2024-41945GHSA-3jcg-vx7f-j6qf

The fuels-ts typescript SDK has no awareness of to-be-spent transactions

Priority MEDIUM 48CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

fuels-ts is a library for interacting with Fuel v2. The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs. The problem occurs, because the `fund` function in `fuels-ts/packages/account/src/account.ts` gets the needed ressources statelessly with the function `getResourcesToSpend` without taking into consideration already used UTXOs. This issue will lead to unexpected SDK behaviour, such as a transaction not getting included in the `txpool` / in a block or a previous transaction silently getting removed from the `txpool` and replaced with a new one.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00309 23rd percentileScored 2026-11-07
Fix Fixed fuels-ts (FuelLabs): 0.93.0@fuel-ts/account (npm): 0.93.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FuelLabsfuels-tsbefore 0.93.00.93.0Patch availableCNA
—@fuel-ts/account (npm)before 0.93.00.93.0Patch availableGHSA-3jcg-vx7f-j6qf
  • fuels-ts VendorFuelLabs Affected before 0.93.0 Fixed in 0.93.0 Patch available CNA
  • @fuel-ts/account (npm) Vendor— Affected before 0.93.0 Fixed in 0.93.0 Patch available GHSA-3jcg-vx7f-j6qf

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:fuellabs:fuels-ts:*:*:*:*:*:*:*:*——FuelLabs
  • cpe:2.3:a:fuellabs:fuels-ts:*:*:*:*:*:*:*:* Versions — — ·FuelLabs

Remediation

  • Fix · CNA fuels-ts (FuelLabs) Fixed in 0.93.0
  • Fix · GHSA-3jcg-vx7f-j6qf @fuel-ts/account (npm) Fixed in 0.93.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-41945
  2. 2026-10-03 Alias added: GHSA-3jcg-vx7f-j6qf

References

Advisory 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences