GitHub Advisoryadvisory · npm
GHSA-587p-w43q-4hjx query-parser-string is vulnerable to Prototype Pollution
CRITICAL
Official page ↗
- Aliases
- CVE-2025-63704
- Ecosystem
- npm
- Packages
- query-string-parser
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-1321
- Reviewed
- 2026-05-12
Affected packages
• npm query-string-parser: 1.0.0 (no fix yet)
Description
NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query parameters and merges them to the newly created object.
Related
Alias · CVE (1)
- CVE-2025-63704 NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. vulnerability
Weakness · CWE (1)
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-63704 advisory
- https://github.com/victorteokw/query-string-parser/issues/3 web
- https://gist.github.com/6en6ar/d62f614dbb2b1032b5e45a56fe26ec8b web
- https://github.com/victorteokw/query-string-parser package
- https://www.npmjs.com/package/query-string-parser?activeTab=readme web