PT-2026-41772 · Milamer+1 · Parse-Nested-Form-Data

0Xbassia · Published 2026-05-18 · Updated 2026-06-01 · CVE-2026-45302

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions parse-nested-form-data versions prior to 1.0.1

Description The parseFormData() function processes bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. An attacker can use a FormData field name that begins with proto or contains . proto . mid-path to cause the parser to traverse onto Object.prototype and assign properties there. This results in prototype pollution, where the prototype chain of every plain object in the running process is contaminated. The issue resides in the handlePathPart() function within src/index.ts, which fails to reject reserved keys during object-type path segment processing. This can lead to corrupted application state, altered control flow, or denial of service in applications that process attacker-controlled FormData, such as HTTP servers.

Recommendations Update to version 1.0.1. As a temporary workaround, validate field names to ensure they do not contain proto, constructor, or prototype before calling the parseFormData() function.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-45302

GHSA-XP7R-J8R6-J9H3

Affected Products

Parse-Nested-Form-Data

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-45302 · Security Note
• https://osv.dev/vulnerability/GHSA-xp7r-j8r6-j9h3 · Vendor Advisory
• https://github.com/milamer/parse-nested-form-data/security/advisories/GHSA-xp7r-j8r6-j9h3 · Note
• https://github.com/milamer/parse-nested-form-data · Note
• https://github.com/milamer/parse-nested-form-data/releases/tag/v1.0.1 · Note
• https://github.com/milamer/parse-nested-form-data/commit/527ad58eb486e32438f7198fb88315c20449d792 · Note