CVE-2026-33993: Locutus prototype pollution via __proto__ injection in unserialize

CVE-2026-33993 · Severity: critical · CVSS 9.8 · Published 2026-03-27

Locutus is a popular JavaScript library that provides PHP function implementations, including the unserialize() function for deserializing PHP-serialized data. The library fails to filter the __proto__ key during deserialization, allowing attackers to inject malicious properties into deserialized objects. This can lead to authorization bypass (if code checks properties like isAdmin), property propagation when objects are copied, and denial of service by overriding built-in methods like hasOwnProperty().

Technologies: locutus (npm). Vendors: npm.

Quick answers

Is CVE-2026-33993 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33993 being exploited in the wild.
How severe is CVE-2026-33993?
Critical severity, with a CVSS score of 9.8, published 27 March 2026.
Which products and versions are affected?
locutus (npm) SEMVER:introduced=0,fixed=3.0.25.
Is there a fix for CVE-2026-33993?
Yes. locutus (npm): upgrade to 3.0.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33993 attacked?
It is attacked over the network.
Am I affected by CVE-2026-33993?
Check whether you run Locutus or locutus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • locutus (npm): upgrade to 3.0.25 or later
    npm install locutus@3.0.25

Technical details

The vulnerability exists in the expectArrayItems() and expectObject() functions within src/php/var/unserialize.ts. Both functions create plain objects ({}) and assign deserialized keys via bracket notation (e.g., items[String(key[0])] = item[0]) without filtering. When the key is __proto__, JavaScript's __proto__ setter is invoked, replacing the object's [[Prototype]] rather than creating a regular property. This allows attackers to inject inherited properties that are accessible via dot notation and the 'in' operator but hidden from Object.keys() and hasOwnProperty(). Injected properties can also propagate to copies made via for...in loops, becoming real own properties. Additionally, attackers can override Object.prototype methods with non-function values, causing TypeErrors. The attack surface is realistic since unserialize() commonly deserializes untrusted PHP-serialized data. The vulnerability was fixed in version 3.0.25 by filtering dangerous keys (__proto__, constructor, prototype) and defining them as plain own properties via Object.defineProperty() instead of bracket notation.

Affected products

  • locutusjs locutus < 3.0.25

Identifiers

  • CVE-2026-33993
  • GHSA-4mph-v827-f877

Timeline

  • 2026-03-27: disclosed
  • 2026-03-25: patched: Fixed in v3.0.25

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.