Prototype Pollution Vulnerability in FlatToNested for JavaScript by Joao Nuno
CVE-2026-55091
7.5HIGH
What is CVE-2026-55091?
The FlatToNested library before version 1.1.2 is susceptible to a prototype pollution vulnerability that arises when it utilizes attacker-influenced fields as keys in internal objects. This design flaw allows an attacker to gain control over the Object.prototype, which can lead to significant security risks such as application logic corruption and denial of service. By supplying manipulated flat records to the convert() function, an attacker may exploit this vulnerability to affect unrelated objects within the inherited state. The issue has been addressed in version 1.1.2.
Affected Version(s)
flat-to-nested-js < 1.1.2