CVE-2025-57328
toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objects. A Prototype Pollution vulnerability in the enable and disable function of toggle-array v1.0.1 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57328?
CVE-2025-57328 is classified as a critical vulnerability due to its potential for Prototype Pollution.
How do I fix CVE-2025-57328?
To fix CVE-2025-57328, update the toggle-array package to version 1.0.2 or later.
Who is affected by CVE-2025-57328?
CVE-2025-57328 affects all versions of the toggle-array package up to and including version 1.0.1.
What are the consequences of exploiting CVE-2025-57328?
Exploiting CVE-2025-57328 may allow attackers to modify Object prototypes, leading to unpredictable application behavior.
Is there a workaround for CVE-2025-57328?
A temporary workaround for CVE-2025-57328 is to avoid using the affected functions of the toggle-array package until an update is applied.