CVE-2026-33994: Locutus Prototype Pollution Vulnerability Due to Incomplete Fix
Summary
CVE-2026-33994: Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521. Affects locutus versions >= 2.0.39, < 3.0.25. Fixed in 3.0.25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Locutus is an npm package that provides a collection of PHP functions for JavaScript. It allows developers to utilize PHP-like functionality in their JavaScript applications. The package is widely used in Node.js environments, but it has been found to have a vulnerability that can lead to prototype pollution, which can compromise the integrity of applications using this library.
Vulnerability Detail
A prototype pollution vulnerability exists in the 'parse_str' function of the npm package locutus. An attacker can exploit this vulnerability by overriding 'RegExp.prototype.test' and then passing a crafted query string to 'parse_str', which allows them to pollute 'Object.prototype'. This issue arises from an incomplete fix for CVE-2026-25521, where the guard mechanism was changed but remained vulnerable to similar attacks. The implications of this vulnerability include potential authentication bypass, denial of service, and even remote code execution if polluted properties are misused.
How To Fix
Minimum fixed version
3.0.25
This is the first release that contains the fix.
npm install locutus@3.0.25Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, a temporary workaround is to avoid using the 'parse_str' function with untrusted input. Additionally, you can implement your own input validation to prevent prototype pollution by checking for forbidden keys directly using string comparison, like so:
if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
break;
}
Conclusion
The locutus package has a prototype pollution vulnerability that can be exploited if not addressed. It is crucial to update to the patched version 3.0.25 to ensure the security of applications using this library. Additionally, developers should be aware of the risks and implement necessary workarounds until they can apply the update.
See every vulnerability recorded for locutus →
FAQ
Prototype pollution is a type of vulnerability that allows an attacker to manipulate an object's prototype, potentially leading to unexpected behavior or security issues in an application.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. You can test your application without signing up at the Vulert playground.
The risks include authentication bypass, denial of service, and remote code execution, which can severely compromise the security and functionality of your application.
Yes, a patch is available in version 3.0.25 of the locutus package. It is recommended to update to this version to mitigate the vulnerability.
If an immediate update is not possible, implement input validation to prevent prototype pollution and avoid using the vulnerable 'parse_str' function with untrusted input.
References
Related vulnerabilities
Recent vulnerabilities recorded for locutus.
