« Back to list

CVE-2025-57353

Status: DeferredMedium (5.3)—

The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the processing of message data, an attacker can manipulate the prototype chain of JavaScript objects by providing specially crafted input. This can result in the injection of arbitrary properties into the Object.prototype, potentially leading to denial of service conditions or unexpected application behavior. The vulnerability allows attackers to alter the prototype of base objects, impacting all subsequent object instances throughout the application's lifecycle.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Openjsf — MessageformatAI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2025-57353",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-57353",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-09-25T18:25:47.554162Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-09-24T18:15:41.793",
  "references": [
    {
      "url": "https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57353",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/messageformat/messageformat/commit/82cd10b40e3f922f990bbcf88a6d14b70c0a3ce0",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/messageformat/messageformat/issues/453",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/messageformat/messageformat/issues/453#issuecomment-3466959449",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/messageformat/messageformat/pull/464",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the processing of message data, an attacker can manipulate the prototype chain of JavaScript objects by providing specially crafted input. This can result in the injection of arbitrary properties into the Object.prototype, potentially leading to denial of service conditions or unexpected application behavior. The vulnerability allows attackers to alter the prototype of base objects, impacting all subsequent object instances throughout the application's lifecycle."
    },
    {
      "lang": "es",
      "value": "Los componentes de tiempo de ejecución del paquete messageformat para Node.js anteriores a la versión 3.0.1 contienen una vulnerabilidad de contaminación de prototipos. Debido a la validación insuficiente de claves de mensaje anidadas durante el procesamiento de datos de mensajes, un atacante puede manipular la cadena de prototipos de objetos JavaScript al proporcionar una entrada especialmente diseñada. Esto puede resultar en la inyección de propiedades arbitrarias en el Object.prototype, lo que podría llevar a condiciones de denegación de servicio o un comportamiento inesperado de la aplicación. La vulnerabilidad permite a los atacantes alterar el prototipo de objetos base, impactando todas las instancias de objetos subsiguientes a lo largo del ciclo de vida de la aplicación. Este problema permanece sin abordar en la última versión disponible."
    }
  ],
  "lastModified": "2026-06-17T09:43:03.853",
  "sourceIdentifier": "cve@mitre.org"
}