GitHub Advisoryadvisory · npm

GHSA-34q3-8x9v-j957 toggle-array vulnerable to prototype pollution

LOW Published 2025-09-24 Modified 2025-09-26 Official page ↗
Aliases
CVE-2025-57328
Ecosystem
npm
Packages
toggle-array
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Weaknesses
CWE-1321
Reviewed
2025-09-26

Affected packages

• npm toggle-array: <= 1.0.1 (no fix yet)

Description

toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objects. A Prototype Pollution vulnerability in the enable and disable function of toggle-array v1.0.1 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.

Related

Alias · CVE (1)

  • CVE-2025-57328 toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other… vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References