CVE-2025-57349: High severity messageformat messageformat vulnerability
The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper handling of message key paths in versions prior to 2.3.0. The flaw arises when processing nested message keys containing special characters (e.g., proto ), which can lead to unintended modification of the JavaScript Object prototype. This vulnerability may allow a remote attacker to inject properties into the global object prototype via specially crafted message input, potentially causing denial of service or other undefined behaviors in applications using the affected component.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57349?
CVE-2025-57349 is a high severity vulnerability due to the risk of prototype pollution.
How do I fix CVE-2025-57349?
To fix CVE-2025-57349, upgrade the messageformat package to version 2.3.0 or later.
What software is affected by CVE-2025-57349?
CVE-2025-57349 affects the messageformat package versions prior to 2.3.0.
What is prototype pollution in the context of CVE-2025-57349?
Prototype pollution in CVE-2025-57349 allows attackers to manipulate JavaScript object prototypes, leading to potential security breaches.
When was CVE-2025-57349 reported?
CVE-2025-57349 was reported in 2025, highlighting vulnerabilities found in the messageformat package.