parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData() walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with __proto__, or contains .__proto__. mid-path, causes the parser to traverse onto Object.prototype and assign properties there, polluting the prototype chain of every plain object in the running process. This issue has been patched in version 1.0.1.

Affected: npm: parse-nested-form-data

## Summary

`parseFormData()` walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with `__proto__`, or contains `.__proto__.` mid-path, causes the parser to traverse onto `Object.prototype` and assign properties there, polluting the prototype chain of every plain object in the running process.

## Details

The vulnerability is in `handlePathPart` in `src/index.ts`, which performs `currentObject[pathPart.path]` and `currentObject[pathPart.path] = val` for object-type path segments without rejecting reserved keys. When the segment is `__proto__`, the read returns `Object.prototype`, which then becomes the next traversal target, and the next assignment lands on the prototype.

Reproduction on a fresh install of `parse-nested-form-data@1.0.0`:

```js import { parseFormData } from 'parse-nested-form-data'; const fd = new FormData(); fd.append('__proto__.polluted', 'yes'); parseFormData(fd); console.log(({}).polluted); // -> 'yes' console.log(([]).polluted); // -> 'yes' ```

Equivalent vectors:

- `__proto__[polluted]=yes` - `a.__proto__.polluted=yes` (mid-path traversal) - `a[0].__proto__.polluted=yes` (mid-path through an array element)

`constructor.prototype.x` was incidentally blocked by an existing duplicate-key guard (because `Object` is a function and failed the JSON-object check), but relying on that was fragile, so the fix denylists `constructor` and `prototype` as wel…