Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/parse-nested-form-data@1.0.0
purl pkg:npm/parse-nested-form-data@1.0.0
Next non-vulnerable version 1.0.1
Latest non-vulnerable version 1.0.1
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-2n1v-a55g-wua7
Aliases:
CVE-2026-45302
GHSA-xp7r-j8r6-j9h3
parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData() walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with __proto__, or contains .__proto__. mid-path, causes the parser to traverse onto Object.prototype and assign properties there, polluting the prototype chain of every plain object in the running process. This issue has been patched in version 1.0.1.
1.0.1
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-11T20:38:40.730259+00:00 GHSA Importer Affected by VCID-2n1v-a55g-wua7 https://github.com/advisories/GHSA-xp7r-j8r6-j9h3 38.6.0