Critical Prototype Pollution Vulnerability in locutus Package
Summary
GHSA-rxrv-835q-v5mh: locutus is vulnerable to Prototype Pollution. Affects locutus versions >= 2.0.12, < 2.0.39. Fixed in 2.0.39. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
locutus is an npm package that provides a collection of PHP functions implemented in JavaScript. It allows developers to utilize PHP-like functionality in JavaScript environments. The package is widely used for web development, particularly in applications that require PHP compatibility. However, it has been found to be vulnerable to a Prototype Pollution issue, which can lead to severe security risks if exploited.
Vulnerability Detail
The Prototype Pollution vulnerability in locutus (versions >2.0.12) allows attackers to manipulate the Object.prototype through crafted input. Despite previous attempts to mitigate this issue by checking for forbidden keys in user input, the vulnerability persists due to the improper use of the includes() function in the parse_str.js file. This can lead to significant security implications, including authentication bypass, denial of service, and potential remote code execution if polluted properties are passed to unsafe functions.
How To Fix
Latest published version: 3.0.36 as of 23 Oct 2026
npm install locutus@3.0.36Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.39
This is the first release that contains the fix.
npm install locutus@2.0.39Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can override the String.prototype.includes method to prevent the exploitation of this vulnerability. Here is a code snippet to demonstrate this workaround:
String.prototype.includes = () => false;
const locutus = require('locutus');
locutus.php.strings.parse_str('constructor[prototype][polluted]=yes');
console.log({}.polluted); // This should not print 'yes' if the workaround is effective.
Conclusion
The locutus package has a critical Prototype Pollution vulnerability that can lead to severe security issues. It is essential to update to the patched version 2.0.39 or later to protect your applications. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for locutus →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to manipulate the prototype of built-in objects in JavaScript, potentially leading to the execution of malicious code or unintended behavior in applications.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can visit the Vulert playground at Vulert Scanner to analyze your package-lock.json without any signup.
The impacts include authentication bypass, denial of service, and remote code execution, which can compromise the security of applications using the locutus package.
Yes, the vulnerability has been patched in version 2.0.39 of the locutus package. It is recommended to update to this version or later.
If an immediate update is not possible, consider implementing the provided workaround to mitigate the risk of exploitation until you can upgrade to a secure version.
References
Related vulnerabilities
Recent vulnerabilities recorded for locutus.
