GHSA-RF6F-7FWH-WJGH
Vulnerability from github – Published: 2026-03-19 17:43 – Updated: 2026-03-25 18:22Summary
The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype.
Root Cause
File: esm/index.js:29 (identical in cjs/index.js)
const resolver = (input, lazy, parsed, $) => output => {
for (let ke = keys(output), {length} = ke, y = 0; y < length; y++) {
const k = ke[y];
const value = output[k];
if (value instanceof Primitive) {
const tmp = input[value]; // Bug is here
No validation that value is a safe numeric index input is built as a plain Array. JavaScript's property lookup on arrays traverses the prototype chain for non-numeric keys. The key "__proto__" resolves to Array.prototype, which:
- has type "object" → passes the typeof tmp === object guard at line 30
- is not in the parsed Set yet → passes the !parsed.has(tmp) guard.
- The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.
Replication Steps
const Flatted = require('flatted');
const parsed = Flatted.parse('[{"x":"__proto__"}]');
parsed.x.polluted = 'pwned';
console.log([].polluted); // Returns true
Impact An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.
Recommended solution Validate that the index string represents an integer within the bounds of input before accessing it:
// Before (vulnerable) const tmp = input[value];
// After (safe) const idx = +value; // coerce boxed String → number const tmp = (Number.isInteger(idx) && idx >= 0 && idx < input.length) ? input[idx] : undefined;
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.4.1"
},
"package": {
"ecosystem": "npm",
"name": "flatted"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33228"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-19T17:43:54Z",
"nvd_published_at": "2026-03-20T23:16:46Z",
"severity": "HIGH"
},
"details": "---\n **Summary**\n\n The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index\n keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it\n with the key \"\\_\\_proto\\_\\_\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate\n parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype\n to the consumer. Any code that subsequently writes to that property will pollute the global prototype.\n\n ---\n **Root Cause**\n\n File: esm/index.js:29 (identical in cjs/index.js)\n```\n const resolver = (input, lazy, parsed, $) =\u003e output =\u003e {\n for (let ke = keys(output), {length} = ke, y = 0; y \u003c length; y++) {\n const k = ke[y];\n const value = output[k]; \n if (value instanceof Primitive) {\n const tmp = input[value]; // Bug is here\n```\n\nNo validation that value is a safe numeric index input is built as a plain Array. JavaScript\u0027s property lookup on arrays traverses the prototype chain for non-numeric keys. The key \"\\_\\_proto\\_\\_\" resolves to Array.prototype, which:\n\n - has type \"object\" \u2192 passes the typeof tmp === object guard at line 30\n - is not in the parsed Set yet \u2192 passes the !parsed.has(tmp) guard.\n - The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.\n ---\n **Replication Steps**\n```\n const Flatted = require(\u0027flatted\u0027); \n const parsed = Flatted.parse(\u0027[{\"x\":\"__proto__\"}]\u0027);\n parsed.x.polluted = \u0027pwned\u0027;\n console.log([].polluted); // Returns true\n``` \n ---\n **Impact**\n An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.\n\n **Recommended solution**\n Validate that the index string represents an integer within the bounds of input before accessing it:\n\n // Before (vulnerable)\n const tmp = input[value];\n\n // After (safe)\n const idx = +value; // coerce boxed String \u2192 number\n const tmp = (Number.isInteger(idx) \u0026\u0026 idx \u003e= 0 \u0026\u0026 idx \u003c input.length)\n ? input[idx]\n : undefined;",
"id": "GHSA-rf6f-7fwh-wjgh",
"modified": "2026-03-25T18:22:00Z",
"published": "2026-03-19T17:43:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WebReflection/flatted/security/advisories/GHSA-rf6f-7fwh-wjgh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33228"
},
{
"type": "WEB",
"url": "https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802"
},
{
"type": "PACKAGE",
"url": "https://github.com/WebReflection/flatted"
},
{
"type": "WEB",
"url": "https://github.com/WebReflection/flatted/releases/tag/v3.4.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Prototype Pollution via parse() in NodeJS flatted"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.