GHSA-ffrw-9mx8-89p8

Suggest an improvement
Source
https://github.com/advisories/GHSA-ffrw-9mx8-89p8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-ffrw-9mx8-89p8/GHSA-ffrw-9mx8-89p8.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-ffrw-9mx8-89p8
Downstream
Withdrawn
2025-11-20T17:27:56Z
Published
2025-09-24T21:30:37Z
Modified
2025-11-20T17:43:01.175537Z
Severity
  • 2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Withdrawn Advisory: fast-redact vulnerable to prototype pollution
Details

Withdrawn Advisory

This advisory has been withdrawn because the issue uses an internal undocumented utility function. This link is maintained to preserve external references.

Original Description

fast-redact is a package that provides do very fast object redaction. A Prototype Pollution vulnerability in the nestedRestore function of fast-redact version 3.5.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.

Database specific 
{
    "nvd_published_at": "2025-09-24T21:15:32Z",
    "github_reviewed_at": "2025-09-29T13:10:15Z",
    "severity": "LOW",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-1321"
    ]
}
References

Affected packages

npm / fast-redact

Package

Name
fast-redact
View open source insights on deps.dev
Purl
pkg:npm/fast-redact

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
3.5.0