Prototype Pollution in querystringify

Description

A vulnerability was found in querystringify before 2.0.0. It’s possible to override built-in properties of the resulting query string object if a malicious string is inserted in the query string.

Recommendation

Update the querystringify package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.0
• Patched version(s): 2.0.0

References

• GHSA-hxcm-v35h-mg2x
• CWE-1321

Related Issues

• Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - CVE-2025-13465
• Prototype Pollution in lodash.merge (GHSA-h726-x36v-rx45) - Vulnerability
• Prototype Pollution in lodash.mergewith (GHSA-5947-m4fg-xhqg) - Vulnerability
• Prototype Pollution in lodash.mergewith - Vulnerability

Tags:

npm

querystringify