High, CVSS 7.5npmAmendedPublished
flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key
CVE-2026-55091 · GHSA-hp36-v28f-w3r4
- Affected
- npm flat-to-nested <= 1.1.1
- Fixed in
- 1.1.2· Vendor fix available
- Issue
- convert() builds the nested tree by using each flat record's id and parent field values directly as object keys, with no guard against proto / constructor / prototype. A record whose parent is the string "proto" makes temp[parent] resolve to Object.prototype, and the following initPush(...) writes attacker-controlled data onto the global prototype. Any application that passes attacker-influenced records to convert() is affected, and the base prototype methods stay intact so the pollution is stealthy. Details In index.js, convert() (FlatToNested.prototype.convert): - temp = {} (line 45) and pendingChildOf = {} (line 46) are plain objects, so they inherit from Object.prototype. - For each record, parent = flatEl[this.config.parent] (line 51) is taken verbatim from input. - Line 57: if (temp[parent] !== undefined) — when parent === "proto", temp["proto"] resolves via the prototype chain to Object.prototype, which is !== undefined, so the branch is taken. - Line 59:…
Recommended action: Upgrade to 1.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.