Vulnerability · Published Aug 12, 2025 · Assigned by GitHub_M
CVE-2025-55164content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE
High 8.8
In plain English
A high-severity prototype pollution in content-security-policy-parser from helmetjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called __proto__, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves disabling prototype method in NodeJS, neutralizing all possible prototype pollution attacks. Provide either --disable-proto=delete (recommended) or --disable-proto=throw as an argument to node to enable this feature.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | content-security-policy-parser | 0.6.0 | GHSA-w2cq-g8g3-gm83 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| helmetjs | content-security-policy-parser | < 0.6.0 |
Weakness: CWE-1321 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/helmetjs/content-security-policy-parser/security/advisories/GHSA-w2cq-g8g3-gm83 x_refsource_CONFIRM
- https://github.com/helmetjs/content-security-policy-parser/issues/11 x_refsource_MISC
- https://github.com/helmetjs/content-security-policy-parser/commit/b13a52554f0168af393e3e38ed4a94e9e6aea9dc x_refsource_MISC
- https://www.vicarius.io/vsociety/posts/cve-2025-55164-detect-node-csp-parser-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-55164-mitigate-csp-parser-vulnerability