#0503
Your API parses bracket-notation query strings — e.g. `user[name]=alice` — into nested objects.
The parser splits each key by `[` and `]` without validating individual segments, so an attacker can send `__proto__[isAdmin]=true` and pollute Object.prototype before any business logic runs.
Query string parsers are among the most common entry points for prototype pollution because user input is split into object keys automatically. Libraries like qs and querystring have shipped real CVEs for exactly this pattern.
parseQueryString('__proto__[isAdmin]=true')// throws: 'Prototype pollution detected'
parseQueryString('user[name]=alice&user[role]=viewer')// returns: {user: {name: 'alice', role: 'viewer'}}