9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-63704

CVE-2025-63704: query-parser-string is vulnerable to Prototype Pollution

NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query parameters and merges them to the newly created object.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-63704

CVE-2025-63704:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
query-string-parser	npm	= 1.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the query-string-parser package, version 1.0.0. The root cause is the lack of sanitization of keys parsed from the query string, which leads to a prototype pollution vulnerability. The analysis of the source code in index.js reveals two key functions involved in the vulnerability.

The queryStringToObject function is the main function that takes the raw query string as input. It splits the query string into key-value pairs and then calls the _fillValue function to construct a nested object. However, it does not validate the keys before passing them on.

The _fillValue function is a recursive function that builds the result object. It uses the keys from the query string to create or modify properties on the object. The vulnerability is triggered when a key is __proto__. In this case, the function modifies the Object.prototype instead of the intended object, retval. Any subsequent object creation in the application will inherit the polluted properties, which can lead to denial of service, remote code execution, or other security impacts.

Since there is no patch available for this vulnerability, any usage of query-string-parser@1.0.0 is considered vulnerable.

Vulnerable functions

_fillValue

index.js

This function recursively assigns properties to an object based on keys derived from the input query string. It does not sanitize the keys, allowing an attacker to use keys like '__proto__' to access and modify the Object.prototype. The line `obj[key] = value;` and `obj[key] || (obj[key] = {});` directly uses the user-provided key to set a property, which leads to prototype pollution if the key is '__proto__'.

queryStringToObject

index.js

This function is the entry point for the vulnerability. It parses the query string and passes the extracted keys and values to the `_fillValue` function without any sanitization. An attacker can provide a malicious query string with `__proto__` which is then processed by this function and passed to `_fillValue`, leading to prototype pollution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.