GitHub Advisoryadvisory · npm

GHSA-xfqm-j7pc-xrfc messageformat has a prototype pollution vulnerability

LOW Published 2025-09-24 Modified 2025-09-25 Official page ↗
Aliases
CVE-2025-57349
Ecosystem
npm
Packages
messageformat
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-1321
Reviewed
2025-09-25

Affected packages

• npm messageformat: < 3.0.0-beta.0 → fixed in 3.0.0-beta.0

Description

The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper handling of message key paths in versions prior to 2.3.0. The flaw arises when processing nested message keys containing special characters (e.g., __proto__ ), which can lead to unintended modification of the JavaScript Object prototype. This vulnerability may allow a remote attacker to inject properties into the global object prototype via specially crafted message input, potentially causing denial of service or other undefined behaviors in applications using the affected component.

Related

Alias · CVE (1)

  • CVE-2025-57349 The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype… vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References