CVE-2025-57352 Overview
CVE-2025-57352 is a prototype pollution vulnerability [CWE-1321] in the min-document npm package prior to version 2.19.0. The flaw resides in the removeAttributeNS method, which improperly handles namespace operations involving the __proto__ property. Attackers can manipulate the JavaScript object prototype chain by supplying crafted input to the affected method. Successful exploitation can lead to denial of service or arbitrary code execution depending on how the application consumes the polluted prototypes. The vulnerability remains unaddressed in the latest available version of the package.
Critical Impact
Unauthenticated attackers can pollute Object.prototype through the removeAttributeNS method, potentially altering application logic across every object in the runtime.
Affected Products
- min-document npm package versions prior to 2.19.0
- Node.js applications that depend on min-document directly or transitively
- JavaScript projects using min-document for DOM emulation in server-side rendering
Discovery Timeline
- 2025-09-24 - CVE-2025-57352 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-57352
Vulnerability Analysis
The min-document package provides a lightweight Document Object Model (DOM) implementation used in server-side JavaScript environments. The vulnerability stems from insufficient validation inside the removeAttributeNS method when processing namespace-qualified attribute removal requests. When the method receives attacker-controlled input referencing the __proto__ property, it operates on the prototype chain instead of the intended attribute map. This produces a classic prototype pollution condition classified under [CWE-1321].
Applications that consume attribute names or namespace URIs from untrusted input propagate the flaw directly to the underlying object. Once Object.prototype is modified, every object in the runtime inherits the injected properties. Downstream effects range from logic bypass and denial of service to arbitrary code execution when polluted properties intersect with security-sensitive code paths.
Root Cause
The root cause is the absence of a guard that rejects prototype-related keys such as __proto__, constructor, and prototype during namespace removal. removeAttributeNS treats these strings as ordinary attribute identifiers and performs property manipulation without validating whether the target key traverses into the prototype chain.
Attack Vector
Exploitation requires the vulnerable application to expose removeAttributeNS to attacker-controlled data, either through HTTP request parsing, template rendering, or user-supplied DOM manipulation. The attack vector is network-based and requires no authentication or user interaction. Attackers submit a payload containing the __proto__ string as the namespace or attribute name, which triggers modification of the global prototype. Technical details and a proof of concept are available in the GitHub Issue Discussion and the GitHub PoC for CVE-2025-57352.
Detection Methods for CVE-2025-57352
Indicators of Compromise
- Requests containing __proto__, constructor, or prototype string values in attribute or namespace parameters
- Unexpected properties appearing on generic JavaScript objects during runtime introspection
- Node.js processes crashing or entering unexpected control flow after handling DOM-serialized input
Detection Strategies
- Perform Software Composition Analysis (SCA) on package-lock.json and yarn.lock to identify min-document versions below 2.19.0
- Instrument runtime hooks that alert when Object.prototype gains new enumerable properties
- Deploy web application firewall (WAF) rules that flag HTTP payloads containing __proto__ inside JSON or XML attribute contexts
Monitoring Recommendations
- Log all invocations of removeAttributeNS with the arguments passed to identify anomalous namespace values
- Track dependency drift with automated tooling and alert on transitive inclusions of vulnerable min-document versions
- Correlate application error spikes with input patterns containing prototype-related strings
How to Mitigate CVE-2025-57352
Immediate Actions Required
- Audit all direct and transitive dependencies for min-document usage in production and build environments
- Apply input validation at the application boundary to reject keys equal to __proto__, constructor, or prototype
- Freeze Object.prototype at application startup using Object.freeze(Object.prototype) where compatible
Patch Information
No patched release of min-document addressing CVE-2025-57352 is available at this time. The vulnerability remains unfixed in the latest published version. Track upstream progress through the GitHub Issue Discussion and plan migration to an actively maintained DOM implementation such as jsdom or linkedom if feasible.
Workarounds
- Wrap removeAttributeNS with a defensive proxy that rejects prototype-related keys before delegation
- Sanitize deserialized objects with libraries such as lodash.defaultsDeep alternatives that block prototype keys
- Replace min-document with a maintained DOM library that enforces safe property assignment
# Configuration example
npm ls min-document
npm uninstall min-document
npm install jsdom
node -e "Object.freeze(Object.prototype); require('./app');"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
