Critical Vulnerability in node-min-document: Prototype Manipulation Risk
Summary
UBUNTU-CVE-2025-57352: A vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in the removeAttributeNS method. Affects node-min-document versions 2.19.0+~cs2.20.2-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The node-min-document package is a lightweight JavaScript library that provides a minimal implementation of the Document Object Model (DOM) for environments where a full DOM is not available. It is commonly used in web applications to manipulate document structures. However, a vulnerability has been identified in versions prior to 2.19.0, which exposes applications to potential security risks due to improper handling of namespace operations.
Vulnerability Detail
A vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in the removeAttributeNS method. By processing malicious input involving the proto property, an attacker can manipulate the prototype chain of JavaScript objects, leading to denial of service or arbitrary code execution. This issue arises from insufficient validation of attribute namespace removal operations, allowing unintended modification of critical object prototypes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot immediately update the package, consider implementing input validation to sanitize any user inputs that may interact with the removeAttributeNS method. This can help mitigate the risk of prototype manipulation.
Conclusion
The node-min-document package has a critical vulnerability that can lead to serious security issues if not addressed. It is essential to update to the latest version to mitigate risks. For ongoing monitoring, consider using tools like Vulert to stay informed about vulnerabilities in your software.
See every vulnerability recorded for node-min-document →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a medium severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application for this vulnerability using the Vulert playground without any signup.
The vulnerability can lead to denial of service or arbitrary code execution, which can compromise the security and functionality of your application.
Yes, the vulnerability has been patched in version 2.19.0 of the node-min-document package.
If immediate updates are not possible, implement input validation to sanitize user inputs that may interact with the vulnerable method.
Related vulnerabilities
Recent vulnerabilities recorded for node-min-document.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
