CVE-2026-45302 Details
Description
parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData() walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with __proto__, or contains .__proto__. mid-path, causes the parser to traverse onto Object.prototype and assign properties there, polluting the prototype chain of every plain object in the running process. This issue has been patched in version 1.0.1.
A prototype pollution vulnerability exists in the parse-nested-form-data module, specifically in versions prior to 1.0.1. The issue arises because the parseFormData() function does not properly filter reserved property keys in FormData field names. This oversight allows an attacker to manipulate the Object.prototype by crafting specific field names, leading to unintended consequences in the application's prototype chain. The vulnerability can be exploited by sending FormData with names that include '__proto__', either as a top-level key or nested within an array.
Users are advised to upgrade to parse-nested-form-data version 1.0.1 or later, where this vulnerability has been fixed. If an immediate upgrade is not possible, validate FormData field names to ensure they do not contain forbidden keys like '__proto__', 'constructor', or 'prototype' before processing the data with parseFormData().
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 1, 2026CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/milamer/parse-nested-form-data/security/advisories/GHSA-xp7r-j8r6-j9h3 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/milamer/parse-nested-form-data/commit/527ad58eb486e32438f7198fb88315c20449d792 | [email protected] | Source CodeVendor |
| https://github.com/milamer/parse-nested-form-data/releases/tag/v1.0.1 | [email protected] | Release NotesVendor |
| https://github.com/milamer/parse-nested-form-data/security/advisories/GHSA-xp7r-j8r6-j9h3 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| milamer parse-nested-form-data | <= 1.0.0 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | New CVE Received | [email protected] |