Open-source package vulnerability · npm
CVE-2025-63704: query-parser-string is vulnerable to Prototype Pollution
criticalCVSS 3.1 9.8GHSA-587p-w43q-4hjx
NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query parameters and merges them to the newly created object.
Published May 7, 2026 · Updated May 12, 2026
Affected packages
query-string-parser
- Ecosystem
- npm
- Affected
- = 1.0.0
- Fixed in
- No patched version yet
- Check
npm ls query-string-parser
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query parameters and merges them to the newly created object.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology