PT-2025-39317 · Node.Js · Messageformat

Published 2025-09-24 · Updated 2025-10-31 · CVE-2025-57353

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions messageformat versions prior to 3.0.2

Description The Runtime components of the messageformat package for Node.js are susceptible to a prototype pollution issue. Insufficient validation of nested message keys during message data processing allows an attacker to manipulate the JavaScript object prototype chain with specially crafted input. This manipulation can lead to the injection of arbitrary properties into the Object.prototype, potentially causing denial of service or unexpected application behavior. The issue allows attackers to alter the prototype of base objects, impacting all subsequent object instances throughout the application's lifecycle.

Recommendations Update to messageformat version 3.0.2 or later.

Exploit

Fix

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-57353

GHSA-6XV4-9CQP-92RH

Affected Products

Messageformat

References · 13

• 🔥 https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57353 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57353 · Security Note
• https://osv.dev/vulnerability/GHSA-6xv4-9cqp-92rh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-57353 · Vendor Advisory
• https://github.com/messageformat/messageformat/commit/82cd10b40e3f922f990bbcf88a6d14b70c0a3ce0 · Note
• https://github.com/messageformat/messageformat/pull/464 · Note
• https://github.com/messageformat/messageformat/issues/453#issuecomment-3466959449 · Note
• https://github.com/messageformat/messageformat/issues/453 · Note
• https://github.com/messageformat/messageformat · Note
• https://t.me/cveNotify/141067 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1971099964441874937 · Twitter Post
• https://t.me/CVEtracker/33276 · Telegram Post
• https://twitter.com/CVEnew/status/1970996107368149267 · Twitter Post