CVE-2026-33994: Locutus Prototype Pollution Vulnerability

CVE-2026-33994 Overview

CVE-2026-33994 is a prototype pollution vulnerability affecting the parse_str function in the Locutus npm package, a library that brings standard libraries of other programming languages to JavaScript for educational purposes. This vulnerability allows attackers to pollute Object.prototype by overriding RegExp.prototype.test and passing a crafted query string to parse_str, effectively bypassing the prototype pollution guard.

This vulnerability represents an incomplete fix for the previously patched CVE-2026-25521, where the original mitigation swapped one hijackable built-in method for another equally vulnerable approach.

Critical Impact

Attackers can bypass prototype pollution guards by exploiting the writable nature of RegExp.prototype.test, potentially leading to property injection, denial of service, or in some cases code execution depending on how the polluted properties are consumed by the application.

Affected Products

• Locutus npm package versions 2.0.39 through 3.0.24
• Applications using the parse_str function from affected Locutus versions
• Node.js environments running vulnerable Locutus versions

Discovery Timeline

• 2026-03-27 - CVE-2026-33994 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-33994

Vulnerability Analysis

This prototype pollution vulnerability exists within the parse_str function of the Locutus package. Prototype pollution is a JavaScript-specific vulnerability class where an attacker can modify the prototype of base objects like Object.prototype, affecting all objects that inherit from it throughout the application runtime.

The vulnerability stems from an incomplete security fix for the earlier CVE-2026-25521. The original patch attempted to prevent prototype pollution by replacing a String.prototype.includes()-based guard with a RegExp.prototype.test()-based guard. However, this fix introduced a new attack surface because RegExp.prototype.test is itself a writable prototype method that attackers can override before invoking the vulnerable function.

By first overriding RegExp.prototype.test to always return false (or a controlled value), an attacker can craft a malicious query string that bypasses the pollution guard entirely. This allows injection of arbitrary properties into Object.prototype, which can then propagate throughout the application's object hierarchy.

Root Cause

The root cause is the reliance on mutable JavaScript built-in prototype methods for security checks. The CVE-2026-25521 patch incorrectly assumed that replacing the String.prototype.includes() check with RegExp.prototype.test() would provide adequate protection. However, both methods exist on writable prototypes that can be tampered with by malicious code executing in the same JavaScript context.

This is a common pitfall in JavaScript security where developers trust built-in methods without accounting for JavaScript's dynamic nature that allows prototype modification.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker exploits this vulnerability by:

1. First overriding RegExp.prototype.test to return a value that bypasses the prototype pollution guard
2. Crafting a malicious query string containing prototype pollution payloads (e.g., __proto__[polluted]=true)
3. Passing the crafted query string to the parse_str function
4. The modified RegExp.prototype.test causes the guard check to fail, allowing the pollution to proceed

The attack complexity involves some prerequisites—specifically, the attacker needs the ability to execute JavaScript code that can modify RegExp.prototype.test before the parse_str call. This could occur in scenarios where user-controlled code runs in the same context, or through chained vulnerabilities.

Detection Methods for CVE-2026-33994

Indicators of Compromise

• Unexpected modifications to Object.prototype or other base JavaScript object prototypes
• Presence of unusual properties on objects that weren't explicitly defined (e.g., isAdmin, polluted)
• Detection of attempts to override RegExp.prototype.test or similar built-in methods
• Anomalous query string patterns containing __proto__, constructor, or prototype keywords

Detection Strategies

• Implement static code analysis to identify usage of Locutus versions between 2.0.39 and 3.0.24
• Deploy runtime monitoring to detect prototype modifications using Object.freeze() or property descriptor watchers
• Use Software Composition Analysis (SCA) tools to identify vulnerable Locutus dependencies in your npm dependency tree
• Monitor application logs for query strings containing prototype pollution indicators

Monitoring Recommendations

• Enable verbose logging for input parsing functions to capture suspicious query string patterns
• Implement integrity checks for critical JavaScript prototype chains at application startup and periodically during runtime
• Set up dependency vulnerability scanning in CI/CD pipelines to catch vulnerable package versions before deployment
• Monitor for npm audit warnings related to the Locutus package

How to Mitigate CVE-2026-33994

Immediate Actions Required

• Upgrade the Locutus package to version 3.0.25 or later immediately
• Audit all projects using npm to identify instances of vulnerable Locutus versions with npm ls locutus
• Review application code for usage of the parse_str function and assess exposure
• Consider implementing Object prototype freezing as an additional defense layer

Patch Information

The vulnerability has been addressed in Locutus version 3.0.25. The fix is available through the GitHub commit and detailed in the GitHub Security Advisory GHSA-vc8f-x9pp-wf5p. The patched version implements a more robust guard that does not rely on overridable prototype methods.

Additional technical details are available in GitHub Pull Request #597 and the v3.0.25 release notes.

Workarounds

• If immediate upgrade is not possible, implement input validation to reject query strings containing __proto__, constructor, or prototype keywords before passing to parse_str
• Freeze critical prototypes at application startup using Object.freeze(Object.prototype) and Object.freeze(RegExp.prototype) to prevent tampering
• Replace usage of the vulnerable parse_str function with alternative query string parsing libraries that have robust prototype pollution protections
• Isolate untrusted code execution in separate JavaScript contexts or worker threads to limit prototype pollution impact

# Upgrade locutus to patched version
npm update locutus@3.0.25

# Verify installed version
npm ls locutus

# Audit for vulnerabilities
npm audit