A prototype pollution vulnerability exists in the Runtime components of the @messageformat/runtime package for Node.js version 3.0.1. This flaw allows attackers to manipulate the prototype chain of JavaScript objects by supplying crafted nested message keys, potentially causing denial of service or unexpected behavior. The issue is fixed in version 3.0.2.