Prototype Pollution in querystringify

Description

A vulnerability was found in querystringify before 2.0.0. It’s possible to override built-in properties of the resulting query string object if a malicious string is inserted in the query string.

Recommendation

Update the querystringify package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.0
• Patched version(s): 2.0.0

References

• GHSA-hxcm-v35h-mg2x
• CWE-1321

Related Issues

• Prototype pollution in emit function - Vulnerability
• Prototype Pollution in json-logic-js - Vulnerability
• Prototype Pollution in lodash.defaultsdeep - lodash.defaultsdeep - Vulnerability
• Conform contains a Prototype Pollution Vulnerability in `parseWith...` function - @conform-to/zod - CVE-2024-32866

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

querystringify