CVE-2024-57075: 
JavaScript vulnerability analysis and mitigation

A prototype pollution vulnerability exists in the lib.Logger function of eazy-logger version 4.0.1. The vulnerability was discovered and disclosed on February 5, 2025, and is tracked as CVE-2024-57075. The vulnerability affects the eazy-logger package, a logging utility for Node.js applications (NVD).

The vulnerability stems from improper input validation in the lib.Logger function, which allows attackers to manipulate the Object prototype through specially crafted payloads. By supplying a payload with Object.prototype setter, an attacker can introduce or modify properties within the global prototype chain. The vulnerability can be exploited by passing malicious input to the lib.Logger function (GitHub POC).

The primary impact of this vulnerability is a potential Denial of Service (DoS) condition. However, the consequences can escalate to other injection-based attacks depending on how the library integrates within the application. If the polluted property propagates to sensitive Node.js APIs (such as exec or eval), it could enable an attacker to execute arbitrary commands within the application's context (GitHub POC).