CVE-2024-57075 Overview
CVE-2024-57075 is a prototype pollution vulnerability in the lib.Logger function of eazy-logger v4.0.1. Attackers can supply a crafted payload to pollute the JavaScript object prototype chain and trigger a Denial of Service (DoS) condition. The flaw is categorized under [CWE-400] Uncontrolled Resource Consumption. Because eazy-logger is a logging dependency used by other Node.js packages, the impact extends to any downstream application that processes attacker-controlled input through the affected logger function.
Critical Impact
Remote, unauthenticated attackers can crash Node.js applications that depend on eazy-logger v4.0.1 by sending a crafted payload that pollutes Object.prototype.
Affected Products
- eazy-logger v4.0.1 (npm package)
- Node.js applications consuming eazy-logger v4.0.1 as a dependency
- Downstream packages that pass untrusted input to lib.Logger
Discovery Timeline
- 2025-02-05 - CVE-2024-57075 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-57075
Vulnerability Analysis
The vulnerability resides in the lib.Logger function of eazy-logger v4.0.1. The function performs an unsafe recursive merge or property assignment on a user-supplied object without filtering dangerous keys such as __proto__, constructor, or prototype. When attacker-controlled JSON is processed, properties are written onto Object.prototype, which then propagate to every object in the running Node.js process.
Properties injected onto Object.prototype can overwrite internal logger configuration, break runtime type checks, or trigger unhandled exceptions in unrelated code paths. The result is a process-level crash and sustained service unavailability. The EPSS score for this issue is 0.53% (40.5 percentile), reflecting low observed exploitation but a straightforward exploitation path.
Root Cause
The root cause is improper input validation during object merging within lib.Logger. The function recursively copies keys from a source object into a target without checking whether the key is __proto__ or whether the target is the prototype object itself. JavaScript's prototype chain semantics then propagate the polluted value to all objects, satisfying the conditions for [CWE-400].
Attack Vector
The attack vector is network-accessible and requires no authentication or user interaction. An attacker submits a JSON payload containing a __proto__ key with malicious nested properties to any endpoint that forwards data into lib.Logger. After pollution, subsequent operations on plain objects inherit the malicious properties and the Node.js process throws or hangs, producing a DoS. The proof-of-concept is published as a GitHub Gist by tariqhawis.
Detection Methods for CVE-2024-57075
Indicators of Compromise
- Inbound HTTP request bodies or query strings containing the literal strings __proto__, constructor.prototype, or prototype in JSON keys.
- Unexpected Node.js process restarts, TypeError exceptions, or uncaughtException events logged after handling user input.
- Sudden changes in logger output format or log entries containing attacker-controlled keys appearing across unrelated requests.
Detection Strategies
- Inspect application logs for repeated crashes correlated with requests routed through eazy-logger.
- Run dependency audits with npm audit or npm ls eazy-logger to identify direct and transitive use of version 4.0.1.
- Deploy a web application firewall rule that flags JSON payloads with keys matching __proto__, constructor, or prototype.
Monitoring Recommendations
- Monitor Node.js process memory and restart counts through your APM or container orchestration platform.
- Alert on uncaughtException and unhandledRejection events emitted by services that load eazy-logger.
- Capture and review request bodies that produced 5xx responses to identify prototype pollution probes.
How to Mitigate CVE-2024-57075
Immediate Actions Required
- Identify all services that depend on eazy-logger v4.0.1, including transitive dependencies, using npm ls eazy-logger.
- Remove or replace the package if no fixed release is available, or pin to a known-safe earlier version after testing.
- Add input validation at every entry point that forwards user data to the logger to reject keys named __proto__, constructor, or prototype.
Patch Information
No official patched version of eazy-logger is referenced in the NVD entry at the time of publication. Maintainers should consult the eazy-logger npm registry page for any updated releases and review the proof-of-concept gist to validate fixes against the documented payload.
Workarounds
- Sanitize incoming JSON by stripping prototype-related keys before passing data to lib.Logger.
- Freeze Object.prototype at application startup using Object.freeze(Object.prototype) to block runtime pollution.
- Replace eazy-logger with an actively maintained logging library such as pino or winston that is not affected by this issue.
- Wrap calls to lib.Logger so that only primitive values, not raw user-supplied objects, are passed as arguments.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
