Description
The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper handling of message key paths in versions prior to 2.3.0. The flaw arises when processing nested message keys containing special characters (e.g.
Recommendation
Update the messageformat package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.3.0
- Patched version(s): 3.0.0-beta.0
References
Could your website be exposed too?
SmartScanner can check your website for messageformat has a prototype pollution vulnerability and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash-amd - CVE-2025-13465
- Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash-es - CVE-2025-13465
- Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash.unset - CVE-2025-13465
- Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - CVE-2025-13465
You might also like:
See something that needs correcting? Let us knowUpdated September 25, 2025