CVE-2026-33994: Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521
(updated )
A prototype pollution vulnerability exists in the parse_str function of the npm package locutus. An attacker can pollute Object.prototype by overriding RegExp.prototype.test and then passing a crafted query string to parse_str, bypassing the prototype pollution guard.
This vulnerability stems from an incomplete fix for CVE-2026-25521. The CVE-2026-25521 patch replaced the String.prototype.includes()-based guard with a RegExp.prototype.test()-based guard. However, RegExp.prototype.test is itself a writable prototype method that can be overridden, making the new guard bypassable in the same way as the original — trading one hijackable built-in for another.
References
- github.com/advisories/GHSA-vc8f-x9pp-wf5p
- github.com/locutusjs/locutus
- github.com/locutusjs/locutus/commit/345a6211e1e6f939f96a7090bfeff642c9fcf9e4
- github.com/locutusjs/locutus/pull/597
- github.com/locutusjs/locutus/releases/tag/v3.0.25
- github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh
- github.com/locutusjs/locutus/security/advisories/GHSA-vc8f-x9pp-wf5p
- nvd.nist.gov/vuln/detail/CVE-2026-33994
Code Behaviors & Features
Detect and mitigate CVE-2026-33994 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →