The NPM package query-string-parser version 1.0.0 merges user supplied query parameters into a newly created object without proper sanitization, leading to prototype pollution. This flaw allows an attacker to inject arbitrary properties into Object.prototype, which may affect the behaviour of any code that reads these properties, potentially causing data corruption, configuration manipulation, or other integrity violations.

Any project that depends on query-string-parser 1.0.0 is potentially affected. The issue is documented for this exact version; later releases may have addressed it.

The vulnerability is exploitable by sending specially crafted query strings to any application that uses the vulnerable library to parse requests. Although the CVSS score is not available in the source, the absence of an EPSS value and lack of listing in KEV indicates that there is currently no known active exploitation, yet the attack vector is local to the application’s request handling layer. Users should assume that the flaw could be leveraged in traffic that reaches the parser.