Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

parse-nested-form-data

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2npmAmendedPublished

    parse-nested-form-data has Prototype Pollution via __proto__ in FormData field names

    CVE-2026-45302 · GHSA-xp7r-j8r6-j9h3

    Affected
    • npm parse-nested-form-data <= 1.0.0
    Fixed in
    1.0.1· Vendor fix available
    Issue
    parseFormData() walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with proto, or contains .proto. mid-path, causes the parser to traverse onto Object.prototype and assign properties there, polluting the prototype chain of every plain object in the running process. Details The vulnerability is in handlePathPart in src/index.ts, which performs currentObject[pathPart.path] and currentObject[pathPart.path] = val for object-type path segments without rejecting reserved keys. When the segment is proto, the read returns Object.prototype, which then becomes the next traversal target, and the next assignment lands on the prototype. Reproduction on a fresh install of parse-nested-form-data@1.0.0: Equivalent vectors: - proto[polluted]=yes - a.proto.polluted=yes (mid-path traversal) - a[0].proto.polluted=yes (mid-path through an array element) constructor.prototype.x was incidentally…

    Recommended action: Upgrade to 1.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →