Description
content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called __proto__, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves disabling prototype method in NodeJS, neutralizing all possible prototype pollution attacks. Provide either --disable-proto=delete (recommended) or --disable-proto=throw as an argument to node to enable this feature.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
helmetjs content-security-policy-parser
< 0.6.0affected
References
- https://github.com/helmetjs/content-security-policy-parser/security/advisories/GHSA-w2cq-g8g3-gm83 ↗
- https://github.com/helmetjs/content-security-policy-parser/issues/11 ↗
- https://github.com/helmetjs/content-security-policy-parser/commit/b13a52554f0168af393e3e38ed4a94e9e6aea9dc ↗
- https://www.vicarius.io/vsociety/posts/cve-2025-55164-detect-node-csp-parser-vulnerability ↗
- https://www.vicarius.io/vsociety/posts/cve-2025-55164-mitigate-csp-parser-vulnerability ↗