CVE-2025-59039 - CVE House
Back to Database
Status published Critical CVE-2025-59039

Prebid Universal Creative on npm briefly compromised

Vulnerability Description

Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should see Prebid.js 9 release notes for suggestions on moving off the deprecated workflow of using the PUC or pointing to a dynamic version of it. PUC users pointing to latest should transition to 1.17.2 as soon as possible to avoid similar attacks in the future.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59039

Credits & Attribution

No credits recorded in the NVD database.

References

More from prebid

View All →
CVE-2025-59038
Prebid.js NPM package briefly compromised
High 8.6

Affected Vendor

Affected Software

prebid-universal-creative
Vulnerable Versions:
= 1.17.3

Timeline

Official Publish: September 9th, 2025
Last Modified: September 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-506

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.