CVE-2025-57354: Counterpart Library Prototype Pollution RCE

CVE-2025-57354 is a prototype pollution vulnerability in the Counterpart translation library for Node.js that enables remote code execution. Attackers exploit insufficient input sanitization to inject properties. This article covers technical details, affected versions, impact, and mitigation strategies.

CVE-2025-57354 Overview

CVE-2025-57354 is a prototype pollution vulnerability in the counterpart internationalization library for Node.js and browser environments. Versions prior to 0.18.6 fail to sanitize user-controlled input passed to the translate method. Attackers can supply translation keys containing prototype chain elements such as __proto__ to inject arbitrary properties into the JavaScript Object prototype. The flaw is tracked as CWE-1321, Improperly Controlled Modification of Object Prototype Attributes.

Critical Impact
Successful exploitation can cause denial-of-service conditions and, depending on the host application, may enable remote code execution through polluted prototype properties.

Affected Products

counterpart library for Node.js, versions prior to 0.18.6
counterpart library for browser JavaScript applications, versions prior to 0.18.6
Downstream applications embedding vulnerable counterpart releases with user-controllable translation keys

Discovery Timeline

2025-09-24 - CVE-2025-57354 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57354

Vulnerability Analysis

The counterpart library provides translation lookups by walking a nested object of locale strings using a dot-separated key path. The translate method accepts a key string as its first parameter and traverses the internal translations object to resolve the matching value. When the library splits the key on its configured separator, it does not filter reserved property names such as __proto__, constructor, or prototype. An attacker who controls the translation key can therefore reach and modify Object.prototype.

Properties injected into Object.prototype are visible to every JavaScript object in the runtime. Downstream code that checks for property existence with in operators, iterates with for...in, or performs option-merging based on truthy values can be steered into attacker-chosen behavior. This class of flaw commonly escalates into denial of service, security control bypass, or arbitrary code execution when polluted properties reach template engines, child process arguments, or dynamic require paths.

Root Cause

The root cause is missing validation of key segments before traversal and assignment within the translation resolution logic. The library trusts the key parameter as safe application data rather than untrusted input. When combined with specific separator configurations, the split key produces segments that match built-in prototype properties, allowing writes to propagate up the prototype chain.

Attack Vector

Exploitation requires an attacker to influence the first parameter of counterpart.translate(). Applications that pass HTTP query parameters, form fields, JSON body values, or WebSocket messages into translation calls expose this path over the network. No authentication or user interaction is required when the translation key surface is reachable from unauthenticated endpoints. Refer to the GitHub proof-of-concept for CVE-2025-57354 and the upstream issue discussion for reproduction details.

Detection Methods for CVE-2025-57354

Indicators of Compromise

Requests containing __proto__, constructor, or prototype tokens in parameters that feed translation lookups
Unexpected properties appearing on plain objects at runtime, observable through Object.prototype.hasOwnProperty audits
Node.js process crashes or TypeError exceptions triggered by unexpected inherited properties
HTTP 5xx spikes correlated with request paths that expose i18n functionality

Detection Strategies

Perform software composition analysis on package-lock.json and yarn.lock to identify counterpart versions below 0.18.6
Inspect application logs for translation calls whose keys include reserved prototype identifiers
Add runtime instrumentation that freezes Object.prototype in non-production builds to surface pollution attempts
Use static analysis to flag data flow from HTTP inputs to counterpart.translate() first arguments

Monitoring Recommendations

Alert on Web Application Firewall (WAF) rules matching __proto__, constructor.prototype, or URL-encoded variants
Monitor Node.js processes for unexpected memory growth and crash loops after i18n activity
Track outbound child process executions originating from web workers that also perform translation lookups

How to Mitigate CVE-2025-57354

Immediate Actions Required

Upgrade the counterpart dependency to version 0.18.6 or later in all Node.js and browser bundles
Audit application code for any path that forwards untrusted input into counterpart.translate() as the key parameter
Deploy input validation that rejects keys containing __proto__, constructor, or prototype segments

Patch Information

The maintainers addressed the flaw in counterpart version 0.18.6. Consult the upstream issue thread for fix details and release notes. Rebuild and redeploy any application bundles that ship the library to browsers, since client-side caches will otherwise continue serving vulnerable code.

Workarounds

Wrap counterpart.translate() calls to allowlist expected keys before invocation
Freeze Object.prototype at application startup with Object.freeze(Object.prototype) where compatibility allows
Use Object.create(null) for internal maps that consume translation output to limit prototype exposure

bash

# Upgrade counterpart to a patched release
npm install counterpart@^0.18.6
npm audit --production