CVE-2025-57349

Vulnerability

Overview The messageformat package, a JavaScript implementation of the Unicode MessageFormat 2 specification, is vulnerable to prototype pollution in versions prior to 2.3.0. The flaw originates from improper handling of nested message key paths that contain special characters like __proto__. This allows an attacker to modify the global JavaScript Object prototype when the library processes specially crafted message input [1][3].

Exploitation and

Attack Surface An attacker can exploit this vulnerability by supplying untrusted message definitions that include nested key paths referencing __proto__. No authentication is required if the application processes user-supplied message inputs. The attack surface includes any application using a vulnerable version of messageformat that handles external message data [1][3].

Impact

Successful exploitation enables property injection into the global Object prototype, which can alter the behavior of all objects in the runtime environment. This may lead to denial of service via application crashes, undefined behavior, or arbitrary property modifications that affect downstream logic [1][3].

Mitigation

Status The issue is fixed in version 2.3.0 and later releases. Users should upgrade to the latest version immediately. No workarounds are documented other than updating the package and avoiding processing untrusted message key inputs on vulnerable versions [2][3].