CVE-2026-25521: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25521 is a prototype pollution vulnerability in the Locutus npm package, which brings standard libraries of other programming languages (such as PHP) to JavaScript for educational purposes. It affects versions from 2.0.12 up to (but not including) 2.0.39, and was published on February 4, 2026. The flaw bypasses a prior prototype pollution mitigation by exploiting the fact that String.prototype.includes() can be overridden by an attacker before calling the vulnerable function. It carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 9.4 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — 'Prototype Pollution') and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). The vulnerability resides in src/php/strings/parse_str.js (lines 77–79), where the previous guard used String.prototype.includes() to check whether user-supplied keys contained forbidden strings such as __proto__, constructor, or prototype. An attacker can override String.prototype.includes = () => false prior to invoking locutus.php.strings.parse_str(), causing the guard to always return false and allowing crafted input like constructor[prototype][polluted]=yes to pollute Object.prototype. The fix replaces the includes() check with a regex test (/__proto__|constructor|prototype/.test(key)), which is not susceptible to String.prototype tampering (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to modify Object.prototype, injecting arbitrary properties that are inherited by all JavaScript objects in the affected process. This can lead to authentication bypass, denial of service through corruption of critical objects, and potentially remote code execution if polluted properties are passed to dangerous sinks such as eval() or child_process functions. The scope is considered changed, meaning the impact can extend beyond the vulnerable component to affect downstream systems and applications that depend on Locutus for input processing (GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, demonstrating the bypass with a minimal code snippet. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.015% (0.000150), indicating a currently low probability of exploitation in the wild (GitHub Advisory, Feedly).

1. Identify target: Locate a Node.js application that uses the locutus npm package (versions 2.0.12–2.0.38) and passes attacker-controlled input to locutus.php.strings.parse_str().
2. Override String.prototype.includes: Before invoking parse_str, inject or arrange for the following code to execute in the same JavaScript context: String.prototype.includes = () => false;. This disables the existing prototype pollution guard.
3. Craft malicious input: Prepare a query string payload targeting Object.prototype, such as constructor[prototype][polluted]=yes or __proto__[polluted]=yes.
4. Invoke parse_str with payload: Call locutus.php.strings.parse_str('constructor[prototype][polluted]=yes'). Because the guard now always returns false, the forbidden key check is bypassed and Object.prototype is polluted.
5. Verify pollution: Confirm that ({}).polluted now returns yes, indicating that all objects in the process inherit the injected property.
6. Leverage pollution: Depending on the application, use the polluted property to trigger authentication bypass, denial of service, or pass the property to a dangerous sink (e.g., eval, child_process.exec) for potential remote code execution (GitHub Advisory, Patch Commit).

• Logs: Node.js application logs showing unexpected property access on plain objects ({}); error traces referencing parse_str with unusual key patterns such as __proto__, constructor[prototype], or prototype.
• File System: Presence of locutus npm package versions between 2.0.12 and 2.0.38 in node_modules/locutus/package.json.
• Process Behavior: Unexpected spawning of child processes (e.g., sh, bash, cmd.exe) from the Node.js application process; unusual outbound network connections from the Node.js process.
• Application Behavior: Authentication bypasses or unexpected privilege escalation in applications using parse_str; application crashes or denial-of-service conditions caused by corrupted object properties inherited from a polluted Object.prototype (GitHub Advisory).

Upgrade the locutus npm package to version 2.0.39 or later, which replaces the vulnerable String.prototype.includes() guard with a regex-based check that cannot be bypassed via prototype tampering. No official configuration-based workaround has been published; upgrading is the only recommended remediation. Organizations should audit all direct and transitive dependencies on locutus and prioritize patching given the high severity scores (GitHub Advisory, Patch Commit, Red Hat Bugzilla).

Red Hat tracked the vulnerability via Bugzilla (Bug 2436950) and assigned it urgent priority, indicating concern about downstream impact on Red Hat products that may depend on Locutus. The GitHub Security Advisory credits four independent researchers (kevgeoleo, reallyTG, vdata1, and cristianstaicu) as finders, suggesting coordinated disclosure. A technical write-up was published by infinitsec.net covering the vulnerability details. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability aggregator postings (Red Hat Bugzilla, GitHub Advisory).