toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objects. A Prototype Pollution vulnerability in the enable and disable function of toggle-array v1.0.1 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.
References
Configurations
History
20 Oct 2025, 16:50
Type | Values Removed | Values Added |
---|---|---|
First Time |
Jonschlinkert toggle-array
Jonschlinkert |
|
CPE | cpe:2.3:a:jonschlinkert:toggle-array:*:*:*:*:*:node.js:*:* | |
References | () https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/toggle-array%401.0.1/index.js - Broken Link | |
References | () https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57328 - Third Party Advisory |
29 Sep 2025, 18:15
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
CWE | CWE-1321 |
24 Sep 2025, 20:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2025-09-24 20:15
Updated : 2025-10-20 16:50
NVD link : CVE-2025-57328
Mitre link : CVE-2025-57328
CVE.ORG link : CVE-2025-57328
JSON object : View
Products Affected
jonschlinkert
- toggle-array
CWE
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')