CVE-2025-57319 Other in n/a
Prototype pollution in fast-redact allows attackers to inject properties into Object.prototype, potentially causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-57319?
CVE-2025-57319 is a high-severity vulnerability in n/a, published on 24 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
fast-redact is a package that provides do very fast object redaction. A Prototype Pollution vulnerability in the nestedRestore function of fast-redact version 3.5.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. NOTE: the Supplier disputes this because the reporter only demonstrated access to properties by an internal utility function, and there is no means for achieving prototype pollution via the public API.
Which versions are affected by CVE-2025-57319?
How do I fix CVE-2025-57319?
Upgrade to a fixed version.
Is CVE-2025-57319 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-57319 exists.
Sources
Also known as CLSA-2026-1774570934, MINI-2rr6-m95v-2v8r, MINI-3m52-56wg-rj55, MINI-62pp-rq24-x5vg, MINI-cxf6-cwvw-345g, MINI-grg6-9qcx-vxg5 and 4 more.