CVE-2025-57349

The messageformat package, a JavaScript implementation of the Unicode MessageFormat 2 specification, is vulnerable to prototype pollution in versions prior to 2.3.0 . The root cause is the improper handling of nested message keys containing special characters like __proto__ during processing. An ...