@messageformat/runtime (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package @messageformat/runtime, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (1)

• CVE-2025-57353 — CVSS 5.3 (medium): The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient…