Node Module Vulnerability in parse-nested-form-data by Milamer

CVE-2026-45302

What is CVE-2026-45302?

The parse-nested-form-data module allows for the parsing of FormData into nested objects. However, prior to version 1.0.1, the parseFormData() function did not properly filter reserved property keys. This vulnerability arises when a FormData field is named beginning with 'proto' or includes '.proto' mid-path. This oversight leads to potential alterations in the Object.prototype, allowing attackers to introduce properties into the prototype chain of all plain objects instantiated afterwards in the application. This poses a significant risk, as it can enable various forms of exploitation leveraging prototype pollution. The issue has been resolved in version 1.0.1.

References