CVE-2025-32014 estree-util-value-to-estree allows prototype pollution in generated ESTree
Prototype pollution in estree-util-value-to-estree allows attackers to manipulate object prototypes, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-32014?
CVE-2025-32014 is a medium-severity vulnerability in remcohaszing estree-util-value-to-estree, published on 7 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named __proto__, valueToEstree would generate an object that specifies a prototype instead. This vulnerability is fixed in 3.3.3.
Weakness: CWE-1321
Which versions are affected by CVE-2025-32014?
2 open source packages ship an affected version, including estree-util-value-to-estree.
| Package | Affected | Fixed in |
|---|---|---|
estree-util-value-to-estree npm | All versions | 3.3.3 |
estree-util-value-to-estree npm | All versions | 3.3.3 |
How do I fix CVE-2025-32014?
Upgrade estree-util-value-to-estree to 3.3.3 or later.
Is CVE-2025-32014 being exploited?
There is no known exploitation of CVE-2025-32014 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1784943105, GHSA-f7f6-9jq7-3rqj, MINI-2mgx-9rqc-rhm5.