CVE-2026-33994: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33994 is a prototype pollution vulnerability in the locutus npm package's parse_str function, stemming from an incomplete fix for CVE-2026-25521. The prior fix replaced a String.prototype.includes()-based guard with a RegExp.prototype.test()-based guard, but this new guard is equally bypassable since RegExp.prototype.test is itself a writable prototype method. Affected versions are >= 2.0.39 and < 3.0.25 of the locutus npm package for Node.js. The advisory was published on March 25, 2026, with a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory).

The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). In parse_str.js, the guard against prototype pollution keys used RegExp.prototype.test() — a prototype method that can itself be overridden by a prior prototype pollution gadget in the same application: if (/__proto__|constructor|prototype/.test(key)) { break }. An attacker who first exploits a separate npm package vulnerability to set RegExp.prototype.test = function() { return false; } can then pass a crafted query string like __proto__[polluted]=yes to parse_str, bypassing the guard entirely and polluting Object.prototype. The fix in v3.0.25 eliminates reliance on any prototype method by using a Set-based lookup (DANGEROUS_PARSE_STR_KEYS.has(key)) and hardening the assignment sink directly, so dangerous key paths are skipped even if regex guards are tampered with (GitHub Advisory, Fix Commit).

Successful exploitation can pollute Object.prototype, affecting all objects in the Node.js process that inherit from it. Depending on how the application uses polluted properties, this can lead to authentication bypass (e.g., if a polluted property is used in access control checks), denial of service (e.g., crashing the application through unexpected property values), or remote code execution if the polluted property reaches dangerous sinks such as eval or child_process. The attack is realistic in Node.js applications that bundle multiple npm packages, where one vulnerable dependency can be used to disable another package's defenses (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating the full chaining scenario with a runnable JavaScript snippet (GitHub Advisory). Exploitation requires a chaining precondition — a separate prototype pollution gadget from another npm package must first override RegExp.prototype.test — making direct unauthenticated exploitation more complex than a standalone vulnerability. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.046% (0.000460), reflecting low current exploitation probability (Feedly).

1. Identify a chaining gadget: Audit the target Node.js application's dependency tree for another npm package vulnerable to prototype pollution that allows overriding RegExp.prototype.test. This is the prerequisite for the attack chain.
2. Exploit the gadget: Use the identified vulnerable dependency to execute code that overrides RegExp.prototype.test to always return false: RegExp.prototype.test = function () { return false; };
3. Craft the malicious payload: Prepare a query string targeting prototype pollution keys, such as __proto__[polluted]=yes or constructor[prototype][polluted]=yes.
4. Trigger parse_str with attacker-controlled input: Ensure the application passes attacker-controlled input to locutus/php/strings/parse_str. With the guard disabled, the function will assign the crafted key to Object.prototype.
5. Verify pollution and escalate: Confirm that ({}).polluted === 'yes', indicating Object.prototype is polluted. Depending on the application, leverage the polluted property to bypass authentication checks, cause denial of service, or reach code execution sinks like eval or child_process (GitHub Advisory).

• Logs: Unexpected or malformed query string parameters containing __proto__, constructor, or prototype keys in application access logs or request logs (e.g., __proto__[polluted]=yes, constructor[prototype][x]=y).
• Application Behavior: Unexpected properties appearing on plain objects ({}) at runtime; authentication logic returning unexpected results due to inherited properties on Object.prototype.
• Process: Node.js process exhibiting anomalous behavior such as unexpected eval execution, spawning of child processes, or crashes caused by prototype property conflicts.
• Dependency Audit: Presence of locutus versions >= 2.0.39 and < 3.0.25 in node_modules or package-lock.json, combined with other npm packages known to be vulnerable to prototype pollution (GitHub Advisory).

Upgrade locutus to version 3.0.25 or later, which hardens parse_str by using a Set-based key check at the assignment sink rather than relying on RegExp.prototype.test, making the guard tamper-resistant (Release v3.0.25, Fix Commit). Additionally, audit the full application dependency tree for other prototype pollution vulnerabilities that could serve as the required chaining gadget, and apply patches to eliminate those vectors. As a defense-in-depth measure, consider using prototype pollution detection libraries (e.g., @nicolo-ribaudo/prototype-pollution-check) and strictly validating all attacker-controlled input before passing it to parse_str (GitHub Advisory).

The locutus maintainer (kvz) acknowledged the report, reproduced the issue against locutus@3.0.24, and confirmed the fix was shipped in locutus@3.0.25 with regression test coverage in test/custom/parse_str-prototype-pollution.vitest.ts (GitHub Advisory). The vulnerability was reported by researcher gtsp233 and is noted as a follow-up to CVE-2026-25521, highlighting the recurring challenge of securing prototype-method-based guards in JavaScript. The advisory was referenced in automated dependency scanning alerts for several downstream projects (Fix PR).