CVE-2025-57353: messageformat Node.js DoS Vulnerability

CVE-2025-57353 Overview

CVE-2025-57353 is a prototype pollution vulnerability in the Runtime components of the messageformat package for Node.js before version 3.0.2. The flaw stems from insufficient validation of nested message keys during message data processing. An attacker can supply specially crafted input that manipulates the JavaScript prototype chain, injecting arbitrary properties into Object.prototype. Because prototype changes affect every subsequent object instance, exploitation can produce denial of service conditions or unexpected application behavior across the entire process lifetime. The vulnerability is classified under [CWE-1321] (Improperly Controlled Modification of Object Prototype Attributes).

Critical Impact

Attackers can inject properties into Object.prototype through untrusted message data, corrupting all objects in the running Node.js application and enabling denial of service.

Affected Products

• @messageformat/runtime package for Node.js
• messageformat package versions prior to 3.0.2
• Node.js applications consuming untrusted message data through the affected runtime

Discovery Timeline

• 2025-09-24 - CVE-2025-57353 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57353

Vulnerability Analysis

The messageformat runtime constructs an internal message store by iterating over keys of a caller-supplied msgData object and assigning values directly to this._data[lc]. The runtime does not create objects with a null prototype and does not filter keys such as __proto__, constructor, or prototype. When message data originates from untrusted input, an attacker can supply nested keys that reach Object.prototype during subsequent property access, injecting attacker-controlled values that every object in the process then inherits.

The consequences are process-wide. Polluted properties can alter control flow in unrelated modules, trigger unexpected exceptions during property lookups, or force branches into error paths that halt request handling. In server-side deployments, this results in reliable denial of service against Node.js workers that ingest attacker-controlled locale or message payloads.

Root Cause

The root cause is direct assignment of user-controlled data to internal objects without prototype isolation. The fix wraps assigned values with _withNullPrototype(), ensuring stored message data cannot participate in prototype chain lookups back to Object.prototype.

Attack Vector

Exploitation requires only network-reachable input that flows into the messageformat runtime constructor. No authentication or user interaction is needed. An attacker submits a JSON payload containing keys such as __proto__ with nested properties, which the vulnerable runtime processes and merges into the prototype chain.

// Patch from mf1/packages/runtime/src/messages.ts
// fix(mf1): Avoid prototype pollution in @messageformat/runtime/messages (#464)
constructor(msgData: { [key: string]: MessageData }, defaultLocale?: string) {
  Object.keys(msgData).forEach(lc => {
    if (lc !== 'toString') {
-     this._data[lc] = msgData[lc];
+     this._data[lc] = _withNullPrototype(msgData[lc]);
      if (defaultLocale === undefined) defaultLocale = lc;
    }
  });

Source: GitHub Commit 82cd10b

Detection Methods for CVE-2025-57353

Indicators of Compromise

• Inbound request bodies containing keys __proto__, constructor, or prototype nested inside message or locale data structures.
• Unexpected properties appearing on plain objects at runtime, such as {}.polluted === <attacker value>.
• Node.js process crashes or TypeError exceptions in code paths that iterate object properties after processing message data.

Detection Strategies

• Perform dependency scanning across Node.js projects to identify messageformat or @messageformat/runtime versions older than 3.0.2.
• Inspect HTTP request logs for JSON payloads containing reserved prototype keys reaching endpoints that render localized messages.
• Add runtime assertions in test environments that check Object.prototype for unexpected enumerable properties after processing external input.

Monitoring Recommendations

• Instrument Node.js applications with structured logging around message compilation to capture unusual key names in incoming data.
• Alert on repeated 5xx responses or worker restarts correlated with requests carrying prototype-related keys.
• Track software composition analysis (SCA) reports for the affected package version and gate deployments on remediation status.

How to Mitigate CVE-2025-57353

Immediate Actions Required

• Upgrade messageformat and @messageformat/runtime to version 3.0.2 or later across all Node.js services.
• Audit application code that passes user-controlled data to the messageformat runtime constructor and restrict inputs to trusted sources.
• Rebuild and redeploy container images or serverless bundles that pin vulnerable versions of the package.

Patch Information

The maintainers addressed the issue in the commit 82cd10b40e3f922f990bbcf88a6d14b70c0a3ce0 by wrapping stored message data with _withNullPrototype(), blocking prototype chain traversal from attacker-supplied keys. Details are tracked in Pull Request #464 and Issue #453.

Workarounds

• Validate and reject any incoming message data containing the keys __proto__, constructor, or prototype before it reaches the runtime.
• Use Object.create(null) for objects constructed from untrusted input to prevent prototype chain participation.
• Apply JSON schema validation on locale and message payloads to constrain allowed property names.

# Upgrade the vulnerable package to the fixed release
npm install messageformat@^3.0.2
npm install @messageformat/runtime@latest

# Verify installed version
npm ls messageformat @messageformat/runtime