Listen to this Post
The vulnerability exists in `handlePathPart` of `src/index.ts` in [email protected]. The function traverses bracket/dot-notation FormData field names to build nested objects using `currentObject[pathPart.path]` reads and writes. It does not reject reserved keys like __proto__. When a path segment is __proto__, the read returns Object.prototype, making that the next traversal target. A subsequent write then assigns a property directly onto Object.prototype. A single attacker-controlled field such as `__proto__.polluted=yes` causes prototype pollution. The parser also accepts mid-path sequences like `a.__proto__.polluted` or a
.__proto__.polluted</code>. While `constructor.prototype` was incidentally blocked by a duplicate-key guard (since `Object` is a function), the fix denylists `constructor` and `prototype` as well. Array-index segments are restricted to digits, so the array branch is not exploitable, but the denylist runs before branching for defense in depth. Any application that feeds untrusted FormData to `parseFormData()` (e.g., HTTP server processing form submissions) allows an unauthenticated attacker to pollute <code>Object.prototype</code>, leading to corrupted state, altered control flow, or denial of service.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: Node.js/JavaScript
Version: 1.0.0
Vulnerability: Prototype Pollution
Severity: Medium
Date: 2026-05-18
<h2 style="color: blue;">Prediction: Patch date 2024-03-15</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
[bash]
Check vulnerable version
npm list parse-nested-form-data
Reproduction
node -e "const {parseFormData}=require('parse-nested-form-data'); const fd=new FormData(); fd.append('<strong>proto</strong>.polluted','yes'); parseFormData(fd); console.log(({}).polluted);"
Upgrade fix
npm install parse-nested-form-data@^1.0.1
Exploit:
`__proto__.polluted=yes`
`a.__proto__.polluted=yes`
`a[bash].__proto__.polluted=yes`
Protection from this CVE:
Upgrade to 1.0.1. If unable, validate field names with `/(^|\.)(__proto__|constructor|prototype)($|[.[])/` before calling parseFormData().
Impact:
Remote unauthenticated prototype pollution → corrupted app state, logic bypass, DoS.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
