CVE-2025-55164
High
Description
content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called __proto__, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves disabling prototype method in NodeJS, neutralizing all possible prototype pollution attacks. Provide either --disable-proto=delete (recommended) or --disable-proto=throw as an argument to node to enable this feature.
SeverityHigh
CVSS8.8
Exploit probability—
ProductContent-security-policy-parser
PublishedAug 12, 2025
First seenAug 12, 2025
Weakness typeCWE-1321Prototype pollution
How to fix
Update
- content-security-policy-parser0.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| content-security-policy-parsernpm | v < 0.6.0 | 0.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.