locutus is vulnerable to Prototype Pollution
Summary
A Prototype Pollution vulnerability exists in the the npm package locutus (>2.0.12). Despite a previous fix that attempted to mitigate Prototype Pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue was fixed in version 2.0.39.
Details
The vulnerability resides in line 77 to 79 of https://github.com/locutusjs/locutus/blob/main/src/php/strings/parse_str.js where includes() function is used to check whether user provided input contain forbidden strings.
PoC
Steps to reproduce
- Install latest version of locutus using npm install or cloning from git
- Run the following code snippet:
String.prototype.includes = () => false;
console.log({}.polluted);
const locutus = require('locutus');
locutus.php.strings.parse_str('constructor[prototype][polluted]=yes');
console.log({}.polluted); // prints yes -> indicating that the patch was bypassed and Prototype Pollution occurredExpected behavior
Prototype Pollution should be prevented and {} should not gain new properties. This should be printed on the console:
undefined
undefined OR throw an ErrorActual behavior
Object.prototype is polluted This is printed on the console:
undefined
yesImpact
This is a Prototype Pollution vulnerability, which can have severe security implications depending on how locutus is used by downstream applications. Any application that processes attacker-controlled input using this locutus.php.strings.parse_str may be affected. It could potentially lead to the following problems:
- Authentication bypass
- Denial of service
- Remote code execution (if polluted property is passed to sinks like eval or child_process)
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | locutus | >= 2.0.12, < 2.0.39 | 2.0.39 |
References
- https://github.com/locutusjs/locutus/security/advisories/GHSA-rxrv-835q-v5mh
- https://nvd.nist.gov/vuln/detail/CVE-2026-25521
- https://github.com/locutusjs/locutus/commit/042af9ca7fde2ff599120783e720a17f335bb01c
- https://access.redhat.com/security/cve/CVE-2026-25521
- https://bugzilla.redhat.com/show_bug.cgi?id=2436950
- https://github.com/locutusjs/locutus
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25521.json
- CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H- Weakness (CWE)
CWE-1321, CWE-915- Platform
- npm
- Package
locutus- Disclosed
- 02.02.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-rxrv-835q-v5mh - CC BY 4.0
Vulnerability history: locutus
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 8
- First → latest
- 05.2021 03.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Critical 4
- High 2
- Medium 2
Disclosures per year
- 2021: 3
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 5
-
locutus is vulnerable to Prototype Pollution this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.