https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-03T19:45:37.115500+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2024-41945 fkie_cve-2024-41945 2026-10-03T19:45:37.152036+00:00

fuels-ts is a library for interacting with Fuel v2. The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs. The problem occurs, because the `fund` function in `fuels-ts/packages/account/src/account.ts` gets the needed ressources statelessly with the function `getResourcesToSpend` without taking into consideration already used UTXOs. This issue will lead to unexpected SDK behaviour, such as a transaction not getting included in the `txpool` / in a block or a previous transaction silently getting removed from the `txpool` and replaced with a new one.

 https://vulnerability.circl.lu/vuln/ghsa-3jcg-vx7f-j6qf GHSA-3jcg-vx7f-j6qf — The fuels-ts typescript SDK has no awareness of to-be-spent transactions 2026-10-03T19:45:37.152144+00:00

Affected: npm: @fuel-ts/account

# Brief/Intro

The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs.

The `Typescript SDK` provides the `fund` function which retrieves `UTXOs`, which belong to the owner and can be used to fund the request in question, from fuel's graphql api. These then get added to the request making it possible to send it to the network as it now has inputs which can be spent by its outputs. Now this works when a user only wants to fund one transaction per block as in the next block, the spent UTXO will not exist anymore. However if a user wants to fund multiple transactions within one block, the following can happen:

It is important to note, that the graphql API will return a random UTXO which has enough value to fund the transaction in question.

- user has 2 spendable `UTXOs` in their wallet which can cover all expenses - user funds transaction `tA` with an input gotten from the API `iA` - user submits `tA` to fuel - `iA` is still in possession of the user as no new block has been produced - user funds a transaction `tB` and gets the same input `iA` from the API - user tries to submit transaction `tB` to fuel but now one of the following can happen: - if the recipient and all other parameters are the same as in `tA`, submission will fail as `tB` will have the same `txHash` as `tA` - if the parameters are different, there will be a collision in the `txpool` and `tA` will…