counterpart vulnerable to prototype pollution

Description

A vulnerability exists in the counterpart library for Node.js and the browser due to insufficient sanitization of user-controlled input in translation key processing. The affected versions prior to 0.18.

Recommendation

No fix is available yet. Followings are affected versions:

<= 0.18.6

References

GHSA-2488-w585-72ch
CVE-2025-57354
CWE-1321
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for counterpart vulnerable to prototype pollution and gives you actionable findings to investigate.

Start a free scan

Related Issues

rollbar vulnerable to Prototype Pollution in merge() - CVE-2025-62517
min-document vulnerable to prototype pollution - CVE-2025-57352
@pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation - CVE-2025-53626
dref is vulnerable to prototype pollution - CVE-2025-26278

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated September 26, 2025