{"id":"CVE-2025-57353","details":"The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the processing of message data, an attacker can manipulate the prototype chain of JavaScript objects by providing specially crafted input. This can result in the injection of arbitrary properties into the Object.prototype, potentially leading to denial of service conditions or unexpected application behavior. The vulnerability allows attackers to alter the prototype of base objects, impacting all subsequent object instances throughout the application's lifecycle.","aliases":["GHSA-6xv4-9cqp-92rh"],"modified":"2026-08-12T03:51:12.681856102Z","published":"2025-09-24T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57353.json"},"references":[{"type":"WEB","url":"https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57353"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57353.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57353"},{"type":"REPORT","url":"https://github.com/messageformat/messageformat/issues/453"},{"type":"REPORT","url":"https://github.com/messageformat/messageformat/issues/453#issuecomment-3466959449"},{"type":"FIX","url":"https://github.com/messageformat/messageformat/commit/82cd10b40e3f922f990bbcf88a6d14b70c0a3ce0"},{"type":"FIX","url":"https://github.com/messageformat/messageformat/pull/464"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/messageformat/messageformat","events":[{"introduced":"0"},{"fixed":"3e5b24afdddaf8932aee6a036acfd1cfd255a91c"},{"fixed":"82cd10b40e3f922f990bbcf88a6d14b70c0a3ce0"}],"database_specific":{"extracted_events":[{"introduced":"Node.js"},{"fixed":"3.0.2"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["messageformat@4.0.0-13","@messageformat/icu-messageformat-1@0.11.0","@messageformat/fluent@0.13.0","@messageformat/icu-messageformat-1@0.10.2","@messageformat/fluent@0.12.3","messageformat@4.0.0-12","@messageformat/fluent@0.12.2","@messageformat/fluent@0.12.1","messageformat@4.0.0-11","@messageformat/icu-messageformat-1@0.10.1","@messageformat/fluent@0.12.0","messageformat@4.0.0-10","@messageformat/number-skeleton@2.0.0-0","@messageformat/icu-messageformat-1@0.10.0","@messageformat/fluent@0.11.0","@messageformat/date-skeleton@2.0.0-0","@messageformat/parser@5.1.1","messageformat@4.0.0-9","@messageformat/icu-messageformat-1@0.9.0","@messageformat/fluent@0.10.0","messageformat@4.0.0-8","@messageformat/icu-messageformat-1@0.8.0","@messageformat/fluent@0.9.0","@messageformat/date-skeleton@1.1.0","@messageformat/core@3.4.0","messageformat@4.0.0-7","@messageformat/icu-messageformat-1@0.7.0","@messageformat/fluent@0.8.0","messageformat@4.0.0-6","@messageformat/icu-messageformat-1@0.6.0","@messageformat/fluent@0.7.0","messageformat@4.0.0-5","@messageformat/icu-messageformat-1@0.5.0","@messageformat/fluent@0.6.0","@messageformat/core@3.3.0","messageformat@4.0.0-4","@messageformat/parser@5.1.0","@messageformat/icu-messageformat-1@0.4.0","@messageformat/fluent@0.5.0","@messageformat/core@3.2.0","@messageformat/number-skeleton@1.2.0","@messageformat/fluent@0.4.1","@messageformat/cli@4.0.1","messageformat@4.0.0-3","@messageformat/icu-messageformat-1@0.3.0","@messageformat/fluent@0.4.0","@messageformat/core@3.1.0","@messageformat/fluent@0.3.1","messageformat@4.0.0-2","@messageformat/fluent@0.3.0","rollup-plugin-messageformat@3.0.0","messageformat@4.0.0-1","@messageformat/icu-messageformat-1@0.2.0","@messageformat/fluent@0.2.0","rollup-plugin-messageformat@2.0.0","messageformat@4.0.0-0","@messageformat/number-skeleton@1.1.0","@messageformat/icu-messageformat-1@0.1.0","@messageformat/fluent@0.1.0","@messageformat/date-skeleton@1.0.1","@messageformat/cli@4.0.0","@messageformat/runtime@3.0.1","@messageformat/core@3.0.1","@messageformat/cli@3.1.0","@messageformat/cli@3.0.1","rollup-plugin-messageformat@1.0.0","@messageformat/runtime@3.0.0","@messageformat/react@1.0.0","@messageformat/parser@5.0.0","@messageformat/number-skeleton@1.0.0","@messageformat/loader@1.0.0","@messageformat/date-skeleton@1.0.0","@messageformat/core@3.0.0","@messageformat/convert@1.0.0","@messageformat/cli@3.0.0","rollup-plugin-messageformat@1.0.0-beta.2","@messageformat/runtime@3.0.0-beta.2","@messageformat/react@1.0.0-beta.1","@messageformat/parser@5.0.0-beta.1","@messageformat/number-skeleton@1.0.0-beta.1","@messageformat/loader@1.0.0-beta.2","@messageformat/date-skeleton@1.0.0-beta.1","@messageformat/core@3.0.0-beta.3","@messageformat/convert@1.0.0-beta.1","@messageformat/cli@3.0.0-beta.2","messageformat@3.0.0-beta.2","messageformat-runtime@3.0.0-beta.1","messageformat-parser@4.1.3","messageformat-loader@1.0.0-beta.1","messageformat-convert@0.4.0","messageformat-cli@3.0.0-beta.1","messageformat@2.3.0","messageformat-website@2.1.2","messageformat-parser@4.1.2","messageformat-loader@0.8.1","messageformat-loader-example@0.3.0","messageformat-formatters@2.0.1","messageformat-convert@0.3.1","messageformat-cli@2.1.1","messageformat@2.2.1","messageformat@2.2.0","messageformat-website@2.1.1","messageformat-parser@4.1.1","messageformat-formatters@2.0.0","messageformat@2.1.0","messageformat-website@2.1.0","messageformat-parser@4.1.0","messageformat-loader@0.8.0","messageformat-loader-example@0.2.0","messageformat-convert@0.3.0","messageformat-cli@2.1.0","v1.0.1","0.2.1","0.3.0-0","0.2.0","v0.1.8","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.1","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57353.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}