Prototype Pollution via parse() in NodeJS flatted

Description

Summary

The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key “__proto__” returns Array.prototype via the inherited getter.

Recommendation

Update the flatted package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.4.1
• Patched version(s): 3.4.2

References

• GHSA-rf6f-7fwh-wjgh
• CVE-2026-33228
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash.unset - CVE-2026-2950
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-es - CVE-2026-2950
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - CVE-2026-2950
• deepHas vulnerable to Prototype Pollution via constructor.prototype - CVE-2026-25047

You might also like:

How to Secure your NodeJs Express Javascript Application - part 2

Update Cheat Sheet for Developers

How to Secure your NodeJs Express Javascript Application - part 1

Tags:

npm

flatted