CVE-2025-57319: High severity fast-redact fast-redact vulnerability
fast-redact is a package that provides do very fast object redaction. A Prototype Pollution vulnerability in the nestedRestore function of fast-redact version 3.5.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. NOTE: the Supplier disputes this because the reporter only demonstrated access to properties by an internal utility function, and there is no means for achieving prototype pollution via the public API.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57319?
CVE-2025-57319 has been classified as a critical severity vulnerability due to its potential to cause denial of service (DoS).
How do I fix CVE-2025-57319?
To fix CVE-2025-57319, update fast-redact to version 3.5.1 or later, which addresses this prototype pollution vulnerability.
What types of attacks can CVE-2025-57319 enable?
CVE-2025-57319 can enable attackers to exploit prototype pollution, leading to potential denial of service and unexpected behavior in applications utilizing the vulnerable package.
Which software versions are affected by CVE-2025-57319?
CVE-2025-57319 affects fast-redact versions 3.5.0 and earlier.
What is prototype pollution in the context of CVE-2025-57319?
Prototype pollution refers to an attack that allows an attacker to inject properties into the Object.prototype, which can lead to unintended modification of objects in JavaScript.