Description
Summary
The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key “__proto__” returns Array.prototype via the inherited getter.
Recommendation
Update the flatted package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.4.1
- Patched version(s): 3.4.2
References
Could your website be exposed too?
SmartScanner can check your website for Prototype Pollution via parse() in NodeJS flatted and gives you actionable findings to investigate.
Start a free scanRelated Issues
- lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash.unset - CVE-2026-2950
- lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-es - CVE-2026-2950
- lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - CVE-2026-2950
- deepHas vulnerable to Prototype Pollution via constructor.prototype - CVE-2026-25047
You might also like:
See something that needs correcting? Let us knowUpdated March 25, 2026