CVE-2025-57319: fast-redact Prototype Pollution Vulnerability

CVE-2025-57319 Overview

A Prototype Pollution vulnerability has been identified in the nestedRestore function of fast-redact, a popular npm package that provides very fast object redaction capabilities. This vulnerability allows attackers to inject properties on Object.prototype via a crafted payload, potentially causing denial of service (DoS) as the minimum consequence.

It is important to note that the supplier disputes this vulnerability, stating that the reporter only demonstrated access to properties by an internal utility function and that there is no means for achieving prototype pollution via the public API.

Critical Impact

Network-accessible prototype pollution vulnerability that can lead to denial of service, affecting applications using fast-redact version 3.5.0 and earlier versions.

Affected Products

• fast-redact version 3.5.0
• fast-redact versions prior to 3.5.0
• Node.js applications utilizing vulnerable fast-redact versions

Discovery Timeline

• 2025-09-24 - CVE CVE-2025-57319 published to NVD
• 2025-09-26 - Last updated in NVD database

Technical Details for CVE-2025-57319

Vulnerability Analysis

This vulnerability is classified as a Prototype Pollution issue affecting the nestedRestore function within the fast-redact package. Prototype Pollution is a JavaScript-specific vulnerability that allows attackers to modify the prototype of base objects like Object.prototype, which can lead to property injection across all objects in the application.

In this case, the vulnerability exists in how the nestedRestore function handles user-supplied input. When processing specially crafted payloads, the function fails to properly validate object keys, allowing attackers to inject properties such as __proto__, constructor, or prototype that propagate to all JavaScript objects within the application context.

The exploitation of this vulnerability requires network access but does not require authentication or user interaction, making it potentially exploitable in automated attack scenarios against exposed applications.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the nestedRestore function. When processing nested object structures for redaction restoration, the function does not properly sanitize or validate property keys. This allows attackers to inject prototype-polluting keys (such as __proto__ or constructor.prototype) that modify the base Object.prototype, affecting all subsequent object instantiations and operations within the application.

The supplier disputes that this is exploitable via the public API, suggesting that while the internal nestedRestore function may be vulnerable, the attack surface may be limited in real-world applications that only interact with the package through its intended interface.

Attack Vector

The attack vector for CVE-2025-57319 is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted JSON payloads to an application that processes user input through the vulnerable fast-redact functions.

The attack typically involves constructing a payload that contains malicious prototype-polluting keys within nested object structures. When processed by the vulnerable nestedRestore function, these keys pollute the JavaScript prototype chain.

For technical details and proof-of-concept implementation, refer to the GitHub PoC Repository and the GitHub Issue Discussion.

Detection Methods for CVE-2025-57319

Indicators of Compromise

• Unusual properties appearing on JavaScript objects that were not explicitly defined
• Application crashes or unexpected behavior related to object property access
• Error logs indicating undefined behavior when accessing standard object methods
• Requests containing suspicious payload patterns with __proto__, constructor, or prototype keys

Detection Strategies

• Implement application-level logging to capture incoming request payloads and flag those containing prototype-polluting patterns
• Deploy web application firewalls (WAF) with rules to detect JSON payloads containing __proto__, constructor.prototype, or similar prototype pollution patterns
• Use static analysis tools (such as ESLint with security plugins) to scan codebases for vulnerable fast-redact versions
• Monitor npm audit output and integrate dependency vulnerability scanning into CI/CD pipelines

Monitoring Recommendations

• Enable verbose logging for applications using fast-redact to capture and analyze processed payloads
• Set up alerts for application exceptions related to prototype or object manipulation errors
• Monitor application behavior for signs of DoS conditions such as increased response times or resource exhaustion
• Review server access logs for patterns consistent with prototype pollution exploitation attempts

How to Mitigate CVE-2025-57319

Immediate Actions Required

• Audit your application's use of fast-redact to determine if the vulnerable nestedRestore function is accessible via your API
• Review the GitHub Issue Discussion to understand the supplier's dispute and assess applicability to your use case
• Implement input validation to sanitize object keys before passing data to fast-redact functions
• Consider implementing Object.freeze on Object.prototype as a defense-in-depth measure

Patch Information

At the time of publication, the vendor disputes this vulnerability, claiming it is not exploitable via the public API. Organizations should monitor the fast-redact GitHub repository for any security updates or official patches. Until a patch is available, implement the workarounds described below to reduce risk.

Workarounds

• Implement strict input validation to reject objects containing __proto__, constructor, or prototype keys before processing with fast-redact
• Use Object.create(null) for creating objects that will be processed by fast-redact to prevent prototype chain pollution
• Consider using alternative redaction libraries that have explicit prototype pollution protections
• Deploy runtime protection mechanisms such as freezing Object.prototype at application startup

# Configuration example - Input validation before fast-redact processing
# Add to your application's input handling middleware

# Example npm audit check for vulnerable packages
npm audit --audit-level=high

# Check installed fast-redact version
npm list fast-redact

# If vulnerable version detected, consider pinning to a safe version when available
npm update fast-redact