CVE-2026-45302

parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData() walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with __proto__, or contains .__proto__. mid-path, causes the parser to traverse onto Object.prototype and assign properties there, polluting the prototype chain of every plain object in the running process. This issue has been patched in version 1.0.1.

• CWE-1321

• https://github.com/milamer/parse-nested-form-data/commit/527ad58eb486e32438f7198fb88315c20449d792
• https://github.com/milamer/parse-nested-form-data/releases/tag/v1.0.1
• https://github.com/milamer/parse-nested-form-data/security/advisories/GHSA-xp7r-j8r6-j9h3
• https://github.com/milamer/parse-nested-form-data/security/advisories/GHSA-xp7r-j8r6-j9h3

Published

Jun 1, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45297OpenReplay is a self-hosted session replay suite. Prior to 1…5.3
• CVE-2026-45298Dozzle is a realtime log viewer for docker containers. Prior…8.6
• CVE-2026-45299Open WebUI is a self-hosted artificial intelligence platform…5.4
• CVE-2026-4530A security flaw has been discovered in apconw Aix-DB up to 1…5.3
• CVE-2026-45300The AsyncHttpClient (AHC) library allows Java applications t…7.4
• CVE-2026-45301Open WebUI is a self-hosted artificial intelligence platform…8.1
• CVE-2026-45303Open WebUI is a self-hosted artificial intelligence platform…7.7
• CVE-2026-45304Symfony is a PHP framework for web and console applications …7.5
• CVE-2026-45305Symfony is a PHP framework for web and console applications …7.5
• CVE-2026-45306pyLoad is a free and open-source download manager written in…6.5
• CVE-2026-45307Speakr is a personal, self-hosted web application designed f…6.1
• CVE-2026-45309AsyncSSH is a Python package which provides an asynchronous …7.5