CVE-2025-55164: content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE
Summary
CVE-2025-55164: content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE. Affects content-security-policy-parser versions < 0.6.0. Fixed in 0.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The content-security-policy-parser is an npm package used for parsing Content Security Policy (CSP) directives in web applications. It allows developers to define security policies that help mitigate risks such as cross-site scripting (XSS) attacks. However, versions 0.5.0 and earlier are susceptible to a prototype pollution vulnerability, which can lead to severe security issues.
Vulnerability Detail
A prototype pollution vulnerability exists in versions 0.5.0 and earlier of the content-security-policy-parser package. By providing a policy name called 'proto', an attacker can override the Object prototype, potentially leading to remote code execution (RCE) through other libraries that expose functionality. This vulnerability can also result in denial of service, as it allows overwriting of properties. Given that CSP is often provided in HTTP queries, network exploitation is a significant risk.
How To Fix
Latest published version: 0.6.0 as of 23 Oct 2026
npm install content-security-policy-parser@0.6.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable prototype methods in Node.js to neutralize potential prototype pollution attacks. Run your Node.js application with the following argument: --disable-proto=delete or --disable-proto=throw. This will help mitigate the risk until you can update the package.
Conclusion
The content-security-policy-parser package has a significant vulnerability that can lead to prototype pollution and potential remote code execution. It is crucial to update to version 0.6.0 or later to mitigate these risks. Additionally, using workarounds can help protect your application until the update is applied.
See every vulnerability recorded for content-security-policy-parser →
FAQ
Prototype pollution is a type of vulnerability that allows an attacker to modify the prototype of built-in objects in JavaScript, which can lead to unexpected behavior and security issues.
If exploited, this vulnerability can allow an attacker to execute arbitrary code or cause denial of service by overwriting critical properties in your application.
If you are using content-security-policy-parser version 0.5.0 or earlier, your application is at risk. You can check for vulnerabilities using Vulert, which monitors your package-lock.json for open-source vulnerabilities.
You should update your package if you are using version 0.5.0 or earlier. The latest version, 0.6.0, contains the necessary patches.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in your software. You can use the Vulert playground to check if your application is affected by this vulnerability without any signup.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
