CVE-2026-33994 is a prototype pollution flaw in the parse_str function of locutus. NVD scores it 9.8. It affects 2.0.39 up to but not including 3.0.25 and comes from an incomplete fix for CVE-2026-25521. Upgrade to 3.0.25. The flaw sits in the query string parser.
What's affected
Versions from 2.0.39 and before 3.0.25 are affected. The earlier patch replaced an includes() based guard with a RegExp.prototype.test() check. The advisory says RegExp.prototype.test is itself writable, so overriding it first bypasses the guard before a crafted query string is parsed.
How to check if you're exposed
npm ls locutus
grep -rn "parse_str" src/
Code that parses untrusted query strings with this function is the exposure.
What to do now
- Upgrade locutus to 3.0.25 or later.
- Prefer built in URL parsing for new code.
- Freeze or harden built in prototypes where practical, for example with the frozen intrinsics option in Node after testing.
- Fix transitive copies through overrides.
Why it matters
The record uses CWE-1321, prototype pollution. Changing Object.prototype affects every object, which can flip checks across the app. The 3.0.25 release hardens parse_str without relying on RegExp.prototype.test. A guard that depends on mutable built ins is only as safe as the code that runs before it. The record is not marked as exploited in the wild and is not in CISA KEV.
Prototype pollution is easiest to see in an example of impact. If an attacker adds a property to the shared base object, every plain object that lacks its own value for that name now reads the attacker's value. Checks like an admin flag can flip for code that never touched the polluted input. A test that parses a hostile looking query string and then checks that a fresh empty object has no unexpected properties is a quick regression guard.
Quick check
Why did the first fix fail?
Its guard used a built in method that an attacker could override first.
Sources
Last reviewed: 19 October 2026.
