CVE-2026-33993 is a prototype injection flaw in the unserialize() function of locutus, which ports standard library functions to JavaScript. NVD scores it 9.8. Upgrade to locutus 3.0.25 now. Check any code that unserializes PHP formatted data from outside your own system.
What's affected
Versions before 3.0.25 are affected. The function assigned deserialized keys with bracket notation without filtering __proto__, so a PHP serialized payload containing that key replaced the object's prototype. The advisory names property injection, propagation through for...in loops, and denial of service by overriding built in methods. It is distinct from the parse_str issue in CVE-2026-33994.
How to check if you're exposed
npm ls locutus
grep -rn "locutus/php/var/unserialize" src/
Only code that unserializes untrusted PHP formatted strings is exposed.
What to do now
- Upgrade locutus to 3.0.25 or later.
- Avoid unserializing untrusted input where you can, and prefer JSON.
- Use overrides to fix transitive copies.
- Keep dependency monitoring on so future releases reach you.
Why it matters
The record uses CWE-1321, improperly controlled modification of object prototype attributes. The 3.0.25 release defines those keys as plain own properties instead of letting them change the prototype. The record is not marked as exploited in the wild and is not in CISA KEV.
Deserialization libraries that mimic another language's format carry this risk because they build JavaScript objects from keys they do not control. The safe pattern is to create objects without a prototype, or to define special keys as plain own properties, which is what the 3.0.25 release does. In your own code, prefer JSON for exchanging data, and validate the shape of parsed data before using it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Same fix as CVE-2026-33994?
Yes, locutus 3.0.25 covers both.
Sources
Last reviewed: 19 October 2026.
