CVE-2025-63704
Prototype Pollution in query-parser-string NPM Package
Publication date: 2026-05-07
Last updated on: 2026-05-08
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| victorteokw | query_string_parser | 1.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1321 | The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the Prototype Pollution vulnerability in the query-parser-string package affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
The vulnerability in the NPM package query-parser-string version 1.0.0 is a Prototype Pollution issue. This occurs because the package does not properly sanitize user-supplied query parameters before merging them into a newly created object.
How can this vulnerability impact me? :
Prototype Pollution vulnerabilities can allow an attacker to manipulate the prototype of base objects, potentially leading to unexpected behavior in the application. This can result in security issues such as denial of service, data corruption, or even remote code execution depending on how the polluted objects are used.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of the Prototype Pollution vulnerability in the query-parser-string package involves identifying if the vulnerable version 1.0.0 is in use and if user-supplied query parameters are being merged unsafely into objects.
Specific commands or automated detection scripts are not provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of the vulnerable query-parser-string package version 1.0.0 or applying patches if available.
Since the vulnerability arises from improper sanitization of user input, ensure that user-supplied query parameters are validated and sanitized before processing.
Monitoring for updates or fixes from the package maintainer and upgrading to a fixed version once released is recommended.