CVE-2025-63704

9.8 criticalEPSS 0.5%

Critical (9.8). EPSS 0.5% chance of exploitation in the next 30 days.

NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query parameters and merges them to the newly created object.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE: CWE-1321
Published: 2026-05-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-587p-w43q-4hjx	npm	query-string-parser	1.0.0	no fix published

References

https://gist.github.com/6en6ar/d62f614dbb2b1032b5e45a56fe26ec8b
https://github.com/victorteokw/query-string-parser/issues/3
https://www.npmjs.com/package/query-string-parser?activeTab=readme

Check your stack JSON