The Runtime components of messageformat package for Node.js before 3.0.2 contain a…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.
Summary
The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the processing of message data, an attacker can manipulate the prototype chain of JavaScript objects by providing specially crafted input. This can result in the injection of arbitrary properties into the Object.prototype, potentially leading to denial of service conditions or unexpected application behavior. The vulnerability allows attackers to alter the prototype of base objects, impacting all subsequent object instances throughout the application's lifecycle.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | @messageformat/runtime (npm) | 3.0.1 to before 3.0.2 | 3.0.2 | Patch available | GHSA-6xv4-9cqp-92rh |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- @messageformat/runtime (npm) Vendor— Affected 3.0.1 to before 3.0.2 Fixed in 3.0.2 Patch available GHSA-6xv4-9cqp-92rh
Remediation
- Fix · GHSA-6xv4-9cqp-92rh @messageformat/runtime (npm) Fixed in 3.0.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-57353
- 2026-10-03 Alias added: GHSA-6xv4-9cqp-92rh
References
Other 6
- https://github.com/messageformat/messageformat/issues/453
- https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57353
- https://github.com/messageformat/messageformat/pull/464
- https://github.com/messageformat/messageformat/commit/82cd10b40e3f922f990bbcf88a6d14b70c0a3ce0
- https://github.com/messageformat/messageformat/issues/453#issuecomment-3466959449
- https://github.com/messageformat/messageformat
Sources
- CVE-2025-57353 · CVE Program
- CVE-2025-57353 · NVD
- FIRST EPSS
- GHSA-6xv4-9cqp-92rh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences