# CVE-2025-57328: jonschlinkert toggle-array prototype pollution in enable and disable functions

Source: https://junglewise.ai/threats/cve-2025-57328-jonschlinkert-toggle-array-prototype-pollution-in-enable-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-24. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2025-57328 · Severity: medium · CVSS 4 · Published 2025-09-24

The toggle-array library, a utility used to manage properties within arrays of objects, is vulnerable to a security flaw that allows attackers to manipulate the fundamental behavior of the application. By providing specially crafted data, an attacker can inject unauthorized properties into the global object prototype. This can lead to application crashes, service outages, or unpredictable behavior across the entire software environment.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-57328 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-57328 being exploited in the wild.

**How severe is CVE-2025-57328?** Medium severity, with a CVSS score of 4, published 24 September 2025.

**Which products and versions are affected?** toggle-array (npm) SEMVER:introduced=0,last_affected=1.0.1.

**Is there a fix for CVE-2025-57328?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-57328 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-57328?** Check whether you run toggle-array (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A prototype pollution vulnerability (CWE-1321) exists in the 'enable' and 'disable' functions of the toggle-array package through version 1.0.1. The vulnerability arises from improper validation of input when modifying object properties within an array, allowing an attacker to inject or modify properties on 'Object.prototype'. This is achievable via a network-based attack vector without authentication. Successful exploitation can lead to a Denial of Service (DoS) or potentially other side effects depending on how the polluted properties are used by the application. As of the advisory date, users should check for updates or implement input validation to prevent malicious payloads from reaching these functions.

## Affected products

- jonschlinkert toggle-array <= 1.0.1

## Identifiers

- CVE-2025-57328
- GHSA-34q3-8x9v-j957

## Timeline

- 2025-09-24: disclosed
- 2025-09-24: advisory

## References

- [https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/toggle-array%401.0.1/index.js](https://github.com/VulnSageAgent/PoCs/blob/main/JavaScript/prototype-pollution/toggle-array%401.0.1/index.js)
- [https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57328](https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57328)
- [https://github.com/jonschlinkert/toggle-array](https://github.com/jonschlinkert/toggle-array)