CVE-2025-63704
Prototype Pollution in query-parser-string NPM Package
Publication date: 2026-05-07
Last updated on: 2026-05-07
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| victorteokw | query_string_parser | 1.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the NPM package query-parser-string version 1.0.0 is a Prototype Pollution issue. This occurs because the package does not properly sanitize user-supplied query parameters before merging them into a newly created object.
How can this vulnerability impact me? :
Prototype Pollution vulnerabilities can allow an attacker to manipulate the prototype of base objects, potentially leading to unexpected behavior in the application. This can result in security issues such as denial of service, data corruption, or even remote code execution depending on how the polluted objects are used.