CVE-2026-55091 Details
Description
flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is __proto__, temp[parent] can resolve to Object.prototype, and initPush() can write attacker-controlled data to the global children prototype property while existing prototype methods remain intact. Any application that passes attacker-influenced flat records to convert() can therefore expose unrelated objects to polluted inherited state, causing application-logic corruption or denial of service and potentially enabling greater impact when a downstream prototype-pollution gadget is present. The constructor and prototype strings are also unsafe inherited-key values in the same lookup design. This issue is fixed in version 1.1.2.
A prototype pollution vulnerability has been identified in the 'flat-to-nested' package, specifically in versions prior to 1.1.2. The issue arises in the 'convert' function, where 'id' and 'parent' fields from flat records are used as keys in temporary objects without proper validation. This flaw allows an attacker to manipulate the prototype of global objects by injecting data through these fields, potentially leading to application logic corruption or a denial-of-service condition. The vulnerability can be exploited by any application that processes untrusted flat records with the 'convert' function. The problem is particularly stealthy, as it does not disrupt existing prototype methods, which remain functional.
Users can upgrade to version 1.1.2, where this vulnerability has been fixed. The patch involves using prototype-less objects for the 'temp' and 'pendingChildOf' lookup tables, preventing inherited keys from being accessed and polluted.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/joaonuno/flat-to-nested-js/commit/680a5ebe1194edda16fa93baaa56ff14fe0e3d7f | [email protected] | Source CodeVendor |
| https://github.com/joaonuno/flat-to-nested-js/releases/tag/v1.1.2 | [email protected] | Release NotesVendor |
| https://github.com/joaonuno/flat-to-nested-js/security/advisories/GHSA-hp36-v28f-w3r4 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| joaonuno flat-to-nested-js | <= 1.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |