Executive Summary

This vulnerability exists in the npm package locutus, specifically in the parse_str function between versions 2.0.39 and before 3.0.25. It is a prototype pollution vulnerability that allows an attacker to modify Object.prototype by overriding RegExp.prototype.test and then passing a crafted query string to parse_str. The issue arises because the guard meant to prevent prototype pollution uses RegExp.prototype.test, which itself can be overridden, allowing the attacker to bypass the protection.

This vulnerability is a result of an incomplete fix for a previous vulnerability (CVE-2026-25521), where the original guard using String.prototype.includes() was replaced with RegExp.prototype.test(), but since RegExp.prototype.test is writable, the new guard can also be bypassed. The vulnerability was fixed in version 3.0.25 with an updated fix.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can perform prototype pollution, which means they can modify the base Object prototype in JavaScript. This can lead to unexpected behavior in applications using the vulnerable parse_str function, potentially causing security issues such as denial of service, data manipulation, or execution of arbitrary code depending on how the polluted prototype is used.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the npm package locutus to version 3.0.25 or later, as this version contains an updated fix for the prototype pollution issue in the parse_str function.

Useful 0 Not Useful 0