GHSA-8f9f-pc5v-9r5h
GitHub Security Advisory
Malicious takeover of previously owned ENS names
✓ GitHub Reviewed
HIGH
Has CVE
Advisory Details
### Impact
A user who owns an ENS domain can set a "trapdoor", allowing them to transfer ownership to another user, and later regain ownership without the new owner's consent or awareness.
### Patches
A new ENS deployment is being rolled out that fixes this vulnerability in the ENS registry. The registry is newly deployed at [0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e](https://etherscan.io/address/0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e).
### Workarounds
Do not accept transfers of ENS domains from other users on the old registrar.
Affected Packages
npm
@ensdomains/ens
Affected versions:
0
(fixed in 0.4.0)
Related CVEs
Key Information
7.5
/10
Dataset
Last updated: August 1, 2025 6:44 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.