min-document vulnerable to prototype pollution

Description

A vulnerability exists in the ‘min-document’ package prior to version 2.19.1, stemming from improper handling of namespace operations in the removeAttributeNS method.

Recommendation

Update the min-document package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.19.0
• Patched version(s): 2.19.1

References

• GHSA-rx8g-88g5-qh64
• CVE-2025-57352
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• rollbar vulnerable to Prototype Pollution in merge() - CVE-2025-62517
• node-cube vulnerable to prototype pollution - CVE-2025-57348
• rollbar vulnerable to prototype pollution - CVE-2025-57325
• mpregular vulnerable to prototype pollution - CVE-2025-57323

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

min-document