Prototype Pollution in querystringify

Description

A vulnerability was found in querystringify before 2.0.0. It’s possible to override built-in properties of the resulting query string object if a malicious string is inserted in the query string.

Recommendation

Update the querystringify package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.0
• Patched version(s): 2.0.0

References

• GHSA-hxcm-v35h-mg2x
• CWE-1321

Related Issues

• plotly.js prototype pollution vulnerability - CVE-2023-46308
• @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defst - Vulnerability
• Prototype Pollution in node-forge debug API. - Vulnerability
• Prototype Pollution in lodash.defaultsdeep - lodash.defaultsdeep - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

querystringify