Skip to content
OpenAdvisories

Package · npm

@messageformat/runtime

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2025-57353

    messageformat prototype pollution vulnerability

    The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the processing of message data, an attacker can manipulate the prototype chain o…

    @messageformat/runtime npm