Executive brief
parse-nested-form-data is a software library used by web servers to organize form submissions into structured data objects. A security flaw allows an attacker to send specially crafted form data that modifies the fundamental behavior of the server's programming environment. This can lead to application crashes, corrupted data, or unauthorized changes to how the server processes other users' requests.
Technical details
A prototype pollution vulnerability exists in the `parseFormData()` function of the `parse-nested-form-data` library prior to version 1.0.1. The `handlePathPart` component in `src/index.ts` fails to filter reserved property keys such as `__proto__`, `constructor`, and `prototype` when traversing nested objects. An unauthenticated remote attacker can provide a FormData field name containing these keys (e.g., `__proto__.polluted`) to traverse onto `Object.prototype` and assign arbitrary properties. This affects all plain objects within the Node.js process. The issue is resolved in version 1.0.1 by implementing a `ForbiddenKeyError` check during path segment processing.
Affected products
- milamer parse-nested-form-data <= 1.0.0
Timeline
- 2026-05-08: patched: Fix committed and version 1.0.1 released.
- 2026-05-12: advisory: GitHub Security Advisory GHSA-xp7r-j8r6-j9h3 published.
- 2026-06-01: disclosed: CVE-2026-45302 published to NVD.