critical vulnerability

locutus is vulnerable to Prototype Pollution

Fix availableCritical · CVSS 9.4EPSS 0.50%

Published Feb 2, 2026 · updated Oct 5, 2026

What to do

Upgrade to a fixed version: locutus 2.0.39.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmlocutus446,997 downloads/week

Vulnerable versions: >= 2.0.12, < 2.0.39
Fixed in: 2.0.39

Check your project: npm ls locutus --all

Is locutus@2.0.39 safe to install? See the upgrade verdict →

Sources

GitHub Advisory GHSA-rxrv-835q-v5mh
NVD CVE-2026-25521

CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes · CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

← All critical vulnerabilities