PT-2026-38453 · Npm · Query-Parser-String

Published 2026-05-07 · Updated 2026-05-08 · CVE-2025-63704

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions query-parser-string version 1.0.0

Description The software is subject to Prototype Pollution, a condition where an attacker can manipulate the prototype of an object to alter the behavior of the application. This occurs because the package fails to properly sanitize user-supplied query parameters before merging them into a newly created object.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-63704

GHSA-587P-W43Q-4HJX

Affected Products

Query-Parser-String

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-63704 · Security Note
• https://osv.dev/vulnerability/GHSA-587p-w43q-4hjx · Vendor Advisory
• https://github.com/victorteokw/query-string-parser · Note
• https://github.com/victorteokw/query-string-parser/issues/3 · Note
• https://gist.github.com/6en6ar/d62f614dbb2b1032b5e45a56fe26ec8b · Note
• https://t.me/cveNotify/162807 · Telegram Post
• https://npmjs.com/package/query-string-parser?activeTab=readme · Note