Skip to content
OpenAdvisories

Package · npm

messageformat

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 7.5
    CVE-2025-57349

    messageformat has a prototype pollution vulnerability

    The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper handling of message key paths in versions prior to 2.3.0. The flaw arises when processing nested mes…

    messageformat npm