query-parser-string is vulnerable to Prototype Pollution

Description

NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query parameters and merges them to the newly created object.

Recommendation

No fix is available yet. Followings are affected versions:

• = 1.0.0

References

• GHSA-587p-w43q-4hjx
• www.npmjs.com
• CVE-2025-63704
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• expr-eval vulnerable to Prototype Pollution - CVE-2025-13204
• expr-eval vulnerable to Prototype Pollution - expr-eval - CVE-2025-13204
• mpregular vulnerable to prototype pollution - CVE-2025-57323
• min-document vulnerable to prototype pollution - CVE-2025-57352

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

query-string-parser