https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 03:48:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-323934 EUVD-2026-323934 https://cve.radiocsirt.org/vuln/euvd-2026-323934 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45302 <p>parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData() walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with __proto__, or contains .__proto__. mid-path, causes the parser to traverse onto Object.prototype and assign properties there, polluting the prototype chain of every plain object in the running process. This issue has been patched in version 1.0.1.</p> <p>parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData() walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with __proto__, or contains .__proto__. mid-path, causes the parser to traverse onto Object.prototype and assign properties there, polluting the prototype chain of every plain object in the running process. This issue has been patched in version 1.0.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45302 https://cve.radiocsirt.org/vuln/ghsa-xp7r-j8r6-j9h3 <p><strong>Affected:</strong> npm: parse-nested-form-data</p> <p>## Summary</p> <p>`parseFormData()` walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with `__proto__`, or contains `.__proto__.` mid-path, causes the parser to traverse onto `Object.prototype` and assign properties there, polluting the prototype chain of every plain object in the running process.</p> <p>## Details</p> <p>The vulnerability is in `handlePathPart` in `src/index.ts`, which performs `currentObject[pathPart.path]` and `currentObject[pathPart.path] = val` for object-type path segments without rejecting reserved keys. When the segment is `__proto__`, the read returns `Object.prototype`, which then becomes the next traversal target, and the next assignment lands on the prototype.</p> <p>Reproduction on a fresh install of `parse-nested-form-data@1.0.0`:</p> <p>```js import { parseFormData } from &#39;parse-nested-form-data&#39;; const fd = new FormData(); fd.append(&#39;__proto__.polluted&#39;, &#39;yes&#39;); parseFormData(fd); console.log(({}).polluted); // -&gt; &#39;yes&#39; console.log(([]).polluted); // -&gt; &#39;yes&#39; ```</p> <p>Equivalent vectors:</p> <p>- `__proto__[polluted]=yes` - `a.__proto__.polluted=yes` (mid-path traversal) - `a[0].__proto__.polluted=yes` (mid-path through an array element)</p> <p>`constructor.prototype.x` was incidentally blocked by an existing duplicate-key guard (because `Object` is a function and failed the JSON-object check), but relying on that was fragile, so the fix denylists `constructor` and `prototype` as wel…</p> <p><strong>Affected:</strong> npm: parse-nested-form-data</p> <p>## Summary</p> <p>`parseFormData()` walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with `__proto__`, or contains `.__proto__.` mid-path, causes the parser to traverse onto `Object.prototype` and assign properties there, polluting the prototype chain of every plain object in the running process.</p> <p>## Details</p> <p>The vulnerability is in `handlePathPart` in `src/index.ts`, which performs `currentObject[pathPart.path]` and `currentObject[pathPart.path] = val` for object-type path segments without rejecting reserved keys. When the segment is `__proto__`, the read returns `Object.prototype`, which then becomes the next traversal target, and the next assignment lands on the prototype.</p> <p>Reproduction on a fresh install of `parse-nested-form-data@1.0.0`:</p> <p>```js import { parseFormData } from &#39;parse-nested-form-data&#39;; const fd = new FormData(); fd.append(&#39;__proto__.polluted&#39;, &#39;yes&#39;); parseFormData(fd); console.log(({}).polluted); // -&gt; &#39;yes&#39; console.log(([]).polluted); // -&gt; &#39;yes&#39; ```</p> <p>Equivalent vectors:</p> <p>- `__proto__[polluted]=yes` - `a.__proto__.polluted=yes` (mid-path traversal) - `a[0].__proto__.polluted=yes` (mid-path through an array element)</p> <p>`constructor.prototype.x` was incidentally blocked by an existing duplicate-key guard (because `Object` is a function and failed the JSON-object check), but relying on that was fragile, so the fix denylists `constructor` and `prototype` as wel…</p> https://cve.radiocsirt.org/vuln/ghsa-xp7r-j8r6-j9h3