CVE-2025-57330: 
JavaScript vulnerability analysis and mitigation

CVE-2025-57330 is a Prototype Pollution vulnerability in the attachToObject function of the web3-core-subscriptions npm package, affecting versions 1.10.4 and earlier (up to and including 2.0.0-alpha.1). It allows unauthenticated remote attackers to inject arbitrary properties onto Object.prototype via a crafted payload, with denial of service (DoS) as the minimum consequence. The vulnerability was published on September 24, 2025. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, though GitHub Advisory rates it Low (2.9) under CVSS v4 (Github Advisory, Feedly).

The vulnerability is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — 'Prototype Pollution'). The root cause lies in the attachToObject function within web3-core-subscriptions, which insufficiently validates or sanitizes user-controlled input during object instantiation, allowing an attacker to supply a specially crafted payload (e.g., keys like __proto__ or constructor) that propagates malicious properties up the prototype chain to Object.prototype. Because all JavaScript objects inherit from Object.prototype, polluted properties can affect the entire application runtime. A public proof-of-concept (PoC) is available in the VulnSageAgent/PoCs GitHub repository (Github Advisory, PoC Repo).

Successful exploitation can cause denial of service by corrupting shared JavaScript runtime state, leading to application crashes or unexpected behavior in any Node.js application using the affected package. Beyond DoS, prototype pollution can in some contexts be escalated to remote code execution if the polluted properties influence security-sensitive code paths (e.g., template engines, eval-like constructs, or deserialization logic). The affected asset scope includes all Ethereum/web3-based Node.js applications that depend on web3-core-subscriptions ≤ 1.10.4 or ≤ 2.0.0-alpha.1 (Github Advisory, PoC Repo).

A public PoC is available in the VulnSageAgent/PoCs GitHub repository, demonstrating exploitation via crafted constructor arguments. No in-the-wild exploitation has been confirmed at this time, and there is no CISA KEV catalog entry for this CVE. The EPSS score is approximately 0.018% (Feedly) to 0.145% (GitHub Advisory, 35th percentile), indicating a currently low probability of active exploitation in the near term (Github Advisory, Feedly).

1. Identify target: Locate Node.js applications using web3-core-subscriptions version ≤ 1.10.4 or ≤ 2.0.0-alpha.1 by inspecting package.json or package-lock.json files, or by querying npm dependency trees.
2. Craft malicious payload: Construct an object with a prototype-polluting key such as {"__proto__": {"polluted": true}} or {"constructor": {"prototype": {"polluted": true}}} intended to be passed as input to the attachToObject function.
3. Deliver payload: Supply the crafted payload during object instantiation or subscription initialization in the web3 subscription workflow, exploiting the lack of input sanitization in attachToObject.
4. Trigger prototype pollution: The malicious properties propagate to Object.prototype, affecting all objects in the JavaScript runtime and potentially causing application crashes (DoS) or influencing downstream logic that relies on prototype-inherited properties.
5. Escalate (if applicable): In environments where polluted prototype properties influence template rendering, command execution, or deserialization, attempt further escalation toward arbitrary code execution (PoC Repo, Github Advisory).

• Logs: Unexpected application crashes or uncaught exceptions in Node.js logs referencing Object.prototype property access or attachToObject; error stack traces originating from web3-core-subscriptions.
• Application Behavior: Sudden undefined behavior or type errors across unrelated parts of the application (a hallmark of prototype pollution); unexpected properties appearing on plain objects ({}) at runtime.
• File System: Presence of web3-core-subscriptions version ≤ 1.10.4 in node_modules/web3-core-subscriptions/package.json.
• Network: Unusual or malformed JSON payloads containing __proto__, constructor, or prototype keys sent to web3 subscription endpoints.

The GitHub Advisory references a fix commit (web3/web3.js@d966042), and users should upgrade web3-core-subscriptions to a version beyond 1.10.4 (and beyond 2.0.0-alpha.1 for alpha users) as soon as a patched release is available. As interim workarounds: validate and sanitize all inputs passed to attachToObject to reject keys such as __proto__, constructor, and prototype; use Object.create(null) to create prototype-less objects where feasible; and consider using libraries like lodash with prototype pollution protections or safe-flat for object merging. Regularly audit npm dependencies with tools like npm audit or Dependabot (Github Advisory).