CVE-2025-57319

Vulnerability

Description

CVE-2025-57319 describes a Prototype Pollution vulnerability in the nestedRestore function of the fast-redact package (version 3.5.0 and earlier). The function does not adequately validate user-supplied paths during object redaction operations, allowing an attacker to inject arbitrary properties into Object.prototype by providing a crafted payload with deeply nested paths [2][3].

Exploitation

Conditions

Exploitation requires the ability to call the fast-redact public API with specially crafted path definitions. The vulnerability is disputed by the supplier, who argues that the reported injection only affects an internal utility function and is not achievable through the public API [1][4]. However, if an application passes user-controlled path strings directly to fast-redact, an attacker may be able to trigger the prototype pollution.

Impact

Successful exploitation can lead to denial of service (DoS) as a minimum consequence, but may also enable data integrity compromises or cross-site scripting (XSS) in applications that rely on the library for sensitive data sanitization [2][3]. The actual impact may be limited as the supplier disputes the practical reachability of the vulnerability.

Mitigation

Status

As of September 2025, no official patch has been released for this vulnerability. The supplier disputes the CVE, and the issue remains open in the project's repository [4]. Users should avoid passing untrusted path input to fast-redact and consider alternative redaction libraries if the risk is deemed unacceptable.