Skip to content
Heist/ feed
Back to feed
Medium

Security advisory

Type: advisorySources: OSVCVE: CVE-2025-57353

The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the processing of message data, an attacker can manipulate the prototype chain of JavaScript objects by providing specially crafted input. This can result in the injection of arbitrary properties into the Object.prototype, potentially leading to denial of service conditions or unexpected application behavior. The vulnerability allows attackers to alter the prototype of base objects, impacting all subsequent object instances throughout the application's lifecycle.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-57353
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 21:04 UTC · Revision 1

Source evidence

CVE-2025-57353

core-osv · Original source

Published 24 Sept 2025, 00:00 UTC

The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the processing of message data, an attacker can manipulate the prototype chain of JavaScript objects by providing specially crafted input. This can result in the injection of arbitrary properties into the Object.prototype, potentially leading to denial of service conditions or unexpected application behavior. The vulnerability allows attackers to alter the prototype of base objects, impacting all subsequent object instances throughout the application's lifecycle.

osv:CVE-2025-57353
Complete source record
{
  "id": "37a2d5ed3620e3729912dbfcb03cbf9a43884498b9dbfdd90b4003b460c5b6e9",
  "url": "https://osv.dev/vulnerability/CVE-2025-57353",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2025-57353",
    "summary": "The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the processing of message data, an attacker can manipulate the prototype chain of JavaScript objects by providing specially crafted input. This can result in the injection of arbitrary properties into the Object.prototype, potentially leading to denial of service conditions or unexpected application behavior. The vulnerability allows attackers to alter the prototype of base objects, impacting all subsequent object instances throughout the application's lifecycle.",
    "evidence": "osv:CVE-2025-57353",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2025-57353",
      "aliases": [
        "CVE-2025-57353",
        "GHSA-6xv4-9cqp-92rh"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/messageformat/messageformat",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "3e5b24afdddaf8932aee6a036acfd1cfd255a91c"
                },
                {
                  "fixed": "82cd10b40e3f922f990bbcf88a6d14b70c0a3ce0"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "3.0.2"
                      }
                    ],
                    "source": "DESCRIPTION"
                  },
                  {
                    "range": [
                      {
                        "fixed": "82cd10b40e3f922f990bbcf88a6d14b70c0a3ce0"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "messageformat@4.0.0-13",
            "@messageformat/icu-messageformat-1@0.11.0",
            "@messageformat/fluent@0.13.0",
            "@messageformat/icu-messageformat-1@0.10.2",
            "@messageformat/fluent@0.12.3",
            "messageformat@4.0.0-12",
            "@messageformat/fluent@0.12.2",
            "@messageformat/fluent@0.12.1",
            "messageformat@4.0.0-11",
            "@messageformat/icu-messageformat-1@0.10.1",
            "@messageformat/fluent@0.12.0",
            "messageformat@4.0.0-10",
            "@messageformat/number-skeleton@2.0.0-0",
            "@messageformat/icu-messageformat-1@0.10.0",
            "@messageformat/fluent@0.11.0",
            "@messageformat/date-skeleton@2.0.0-0",
            "@messageformat/parser@5.1.1",
            "messageformat@4.0.0-9",
            "@messageformat/icu-messageformat-1@0.9.0",
            "@messageformat/fluent@0.10.0",
            "messageformat@4.0.0-8",
            "@messageformat/icu-messageformat-1@0.8.0",
            "@messageformat/fluent@0.9.0",
            "@messageformat/date-skeleton@1.1.0",
            "@messageformat/core@3.4.0",
            "messageformat@4.0.0-7",
            "@messageformat/icu-messageformat-1@0.7.0",
            "@messageformat/fluent@0.8.0",
            "messageformat@4.0.0-6",
            "@messageformat/icu-messageformat-1@0.6.0",
            "@messageformat/fluent@0.7.0",
            "messageformat@4.0.0-5",
            "@messageformat/icu-messageformat-1@0.5.0",
            "@messageformat/fluent@0.6.0",
            "@messageformat/core@3.3.0",
            "messageformat@4.0.0-4",
            "@messageformat/parser@5.1.0",
            "@messageformat/icu-messageformat-1@0.4.0",
            "@messageformat/fluent@0.5.0",
            "@messageformat/core@3.2.0",
            "@messageformat/number-skeleton@1.2.0",
            "@messageformat/fluent@0.4.1",
            "@messageformat/cli@4.0.1",
            "messageformat@4.0.0-3",
            "@messageformat/icu-messageformat-1@0.3.0",
            "@messageformat/fluent@0.4.0",
            "@messageformat/core@3.1.0",
            "@messageformat/fluent@0.3.1",
            "messageformat@4.0.0-2",
            "@messageformat/fluent@0.3.0",
            "rollup-plugin-messageformat@3.0.0",
            "messageformat@4.0.0-1",
            "@messageformat/icu-messageformat-1@0.2.0",
            "@messageformat/fluent@0.2.0",
            "rollup-plugin-messageformat@2.0.0",
            "messageformat@4.0.0-0",
            "@messageformat/number-skeleton@1.1.0",
            "@messageformat/icu-messageformat-1@0.1.0",
            "@messageformat/fluent@0.1.0",
            "@messageformat/date-skeleton@1.0.1",
            "@messageformat/cli@4.0.0",
            "@messageformat/runtime@3.0.1",
            "@messageformat/core@3.0.1",
            "@messageformat/cli@3.1.0",
            "@messageformat/cli@3.0.1",
            "rollup-plugin-messageformat@1.0.0",
            "@messageformat/runtime@3.0.0",
            "@messageformat/react@1.0.0",
            "@messageformat/parser@5.0.0",
            "@messageformat/number-skeleton@1.0.0",
            "@messageformat/loader@1.0.0",
            "@messageformat/date-skeleton@1.0.0",
            "@messageformat/core@3.0.0",
            "@messageformat/convert@1.0.0",
            "@messageformat/cli@3.0.0",
            "rollup-plugin-messageformat@1.0.0-beta.2",
            "@messageformat/runtime@3.0.0-beta.2",
            "@messageformat/react@1.0.0-beta.1",
            "@messageformat/parser@5.0.0-beta.1",
            "@messageformat/number-skeleton@1.0.0-beta.1",
            "@messageformat/loader@1.0.0-beta.2",
            "@messageformat/date-skeleton@1.0.0-beta.1",
            "@messageformat/core@3.0.0-beta.3",
            "@messageformat/convert@1.0.0-beta.1",
            "@messageformat/cli@3.0.0-beta.2",
            "messageformat@3.0.0-beta.2",
            "messageformat-runtime@3.0.0-beta.1",
            "messageformat-parser@4.1.3",
            "messageformat-loader@1.0.0-beta.1",
            "messageformat-convert@0.4.0",
            "messageformat-cli@3.0.0-beta.1",
            "messageformat@2.3.0",
            "messageformat-website@2.1.2",
            "messageformat-parser@4.1.2",
            "messageformat-loader@0.8.1",
            "messageformat-loader-example@0.3.0",
            "messageformat-formatters@2.0.1",
            "messageformat-convert@0.3.1",
            "messageformat-cli@2.1.1",
            "messageformat@2.2.1",
            "messageformat@2.2.0",
            "messageformat-website@2.1.1",
            "messageformat-parser@4.1.1",
            "messageformat-formatters@2.0.0",
            "messageformat@2.1.0",
            "messageformat-website@2.1.0",
            "messageformat-parser@4.1.0",
            "messageformat-loader@0.8.0",
            "messageformat-loader-example@0.2.0",
            "messageformat-convert@0.3.0",
            "messageformat-cli@2.1.0",
            "v1.0.1",
            "0.2.1",
            "0.3.0-0",
            "0.2.0",
            "v0.1.8",
            "v0.1.7",
            "v0.1.6",
            "v0.1.5",
            "v0.1.4",
            "v0.1.1",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57353.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:23.634315836Z",
      "provider": "osv",
      "references": [
        "https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57353",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57353.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-57353",
        "https://github.com/messageformat/messageformat/issues/453",
        "https://github.com/messageformat/messageformat/issues/453#issuecomment-3466959449",
        "https://github.com/messageformat/messageformat/commit/82cd10b40e3f922f990bbcf88a6d14b70c0a3ce0",
        "https://github.com/messageformat/messageformat/pull/464"
      ],
      "provider_metadata": {
        "cna_assigner": "mitre",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57353.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-57353",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 490044,
  "published_at": "2025-09-24T00:00:00+00:00"
}