CVE-2025-57317 Details
Description
apidoc-core is the core parser library to generate apidoc result following the apidoc-spec. A Prototype Pollution vulnerability in the preProcess function of apidoc-core versions thru 0.15.0 allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.
A prototype pollution vulnerability has been identified in the apidoc-core library, specifically in versions through 0.15.0. This vulnerability arises in the preProcess function within the 'apidoc-core/lib/workers/api_body_title' module. The issue allows attackers to inject properties into Object.prototype by sending a crafted payload, which can disrupt the integrity of object inheritance chains. The primary consequence of this vulnerability is a denial-of-service condition, as the prototype pollution can lead to unintended behavior in applications that depend on the correctness of prototype chains.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 25, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| apidocjs apidoc-core | <= 0.15.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2025 | Initial Analysis | [email protected] |
| Sep 25, 2025 | CVE Modified | CISA-ADP |
| Sep 25, 2025 | New CVE Received | [email protected] |