CVE-2025-57319

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-57319
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57319.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-57319
Downstream
CGA (92)
CLSA (1)
MINI (9)
Published
2025-09-24T00:00:00Z
Modified
2026-10-28T02:30:29Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

fast-redact is a package that provides do very fast object redaction. A Prototype Pollution vulnerability in the nestedRestore function of fast-redact version 3.5.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence. NOTE: the Supplier disputes this because the reporter only demonstrated access to properties by an internal utility function, and there is no means for achieving prototype pollution via the public API.

Database specific 
{
    "cna_assigner":  "mitre",
    "isDisputed":  true,
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57319.json"
}
References

Affected packages

Git / github.com/davidmarkclements/fast-redact

Affected ranges

Type
GIT
Repo
https://github.com/davidmarkclements/fast-redact
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
e268c1c3b5a3be770f8082583f626bc4ba5c648d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "3.5.0"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.13
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.2.0
v1.3.0
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.5.0
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.1.0
v3.1.1
v3.1.2
v3.2.0
v3.3.0
v3.4.0
v3.4.1
v3.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-57319.json"