Improper Synchronization Affecting github.com/mezo-org/mezod/precompile package, versions <8.0.0
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of Concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMMEZOORGMEZODPRECOMPILE-16776800
- published20 May 2026
- disclosed6 May 2026
- creditDeltaXV
Introduced: 6 May 2026
CVE NOT AVAILABLE CWE-662 Â (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade github.com/mezo-org/mezod/precompile to version 8.0.0 or higher.
Overview
Affected versions of this package are vulnerable to Improper Synchronization through the bridgeOut precompile. An attacker can restore their ERC-20 token balance and allowance after a burn operation by exploiting stale state overwrites in the dual-context state management, enabling repeated unauthorized withdrawals of assets from the L1 bridge.