Prototype Pollution in querystringify

Description

A vulnerability was found in querystringify before 2.0.0. It’s possible to override built-in properties of the resulting query string object if a malicious string is inserted in the query string.

Recommendation

Update the querystringify package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.0
• Patched version(s): 2.0.0

References

• GHSA-hxcm-v35h-mg2x
• CWE-1321

Related Issues

• DOMPurify USE_PROFILES prototype pollution allows event handlers - Vulnerability
• Prototype Pollution in node-forge util.setPath API - Vulnerability
• Prototype Pollution in lodash.mergewith - Vulnerability
• Prototype Pollution in lodash.mergewith - lodash.mergewith - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

querystringify