CVE-2025-57349

CVE-2025-57349 affects the messageformat package (JavaScript) prior to version 2.3.0. The root cause is improper handling of nested message keys containing special characters (e.g., proto ), enabling prototype pollution that can modify Object.prototype and cause denial of service or undefined beh...