CVE-2025-57349 messageformat has a prototype pollution vulnerability
Remote attackers can cause denial of service or undefined behavior via prototype pollution in the messageformat JavaScript library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-57349?
CVE-2025-57349 is a high-severity vulnerability in n/a, published on 24 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper handling of message key paths in versions prior to 2.3.0. The flaw arises when processing nested message keys containing special characters (e.g., __proto__ ), which can lead to unintended modification of the JavaScript Object prototype. This vulnerability may allow a remote attacker to inject properties into the global object prototype via specially crafted message input, potentially causing denial of service or other undefined behaviors in applications using the affected component.
Weakness: CWE-1321
Which versions are affected by CVE-2025-57349?
2 open source packages ship an affected version, including messageformat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
messageformat npm | All versions | 3.0.0-beta.0 |
messageformat npm | All versions | 3.0.0-beta.0 |
Products include Openjsf Messageformat.
How do I fix CVE-2025-57349?
Upgrade messageformat to 3.0.0-beta.0 or later.
Is CVE-2025-57349 being exploited?
There is no known exploitation of CVE-2025-57349 in the wild and no public exploit code.
Sources
Also known as GHSA-xfqm-j7pc-xrfc.