{"action":"No fix published. Pin and monitor.","affected":[],"component":"query-string-parser","cve_ids":["CVE-2025-63704"],"ecosystem":"npm","epss":0.00476,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-587p-w43q-4hjx","id":"tcs_01M5KF318H31FE9EXXB5QWK4H5","modified_at":"2026-05-12T17:26:28.825256Z","published_at":"2026-05-07T18:30:40Z","references":["https://osv.dev/vulnerability/GHSA-587p-w43q-4hjx","https://nvd.nist.gov/vuln/detail/CVE-2025-63704","https://github.com/victorteokw/query-string-parser/issues/3","https://gist.github.com/6en6ar/d62f614dbb2b1032b5e45a56fe26ec8b","https://github.com/victorteokw/query-string-parser","https://www.npmjs.com/package/query-string-parser?activeTab=readme"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-587p-w43q-4hjx","url":"https://osv.dev/vulnerability/GHSA-587p-w43q-4hjx"}],"summary":"query-parser-string is vulnerable to Prototype Pollution"}