Bug 2397978 (CVE-2025-57319)

Summary: CVE-2025-57319 fast-redact: fast-redact prototype pollution
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aarif, abarbaro, alcohan, aprice, chfoley, dbosanac, dhanak, drosa, dsimansk, gparvin, haoli, hkataria, jajackso, jbalunas, jcammara, jchui, jhe, jkoehler, jmitchel, jneedle, jreimann, jscholz, kegrant, kingland, koliveir, kshier, ktsao, kverlaen, lphiri, mabashia, matzew, mdessi, mnovotny, mpierce, mrizzi, nboldt, owatkins, pahickey, pbraun, pcattana, psrna, rhaigner, sausingh, sdawley, shvarugh, simaishi, smcdonal, stcannon, swoodman, teagle, tfister, thavo, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A prototype pollution flaw has been discovered in the fast-redact npm module. The nestedRestore function of fast-redact allows attackers to inject properties on Object.prototype via supplying a crafted payload.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-09-24 21:02:10 UTC
fast-redact is a package that provides do very fast object redaction. A Prototype Pollution vulnerability in the nestedRestore function of fast-redact version 3.5.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.