Prototype Pollution Vulnerability in spmrc Package Affecting Node.js Applications

CVE-2025-57327

What is CVE-2025-57327?

The spmrc package, which acts as a resource controller for spm, has a vulnerability that allows attackers to exploit the set and config functions. By providing specially crafted payloads, there is a risk of injecting properties into Object.prototype. This can lead to unexpected behavior in applications that utilize the package, with potential consequences such as denial of service. It is crucial for developers to review their implementation of spmrc and apply necessary updates to safeguard their applications from malicious exploitation.

References