CVE-2026-33228: Flatted Information Disclosure Flaw

CVE-2026-33228 Overview

CVE-2026-33228 is a Prototype Pollution vulnerability in the flatted npm package, a popular circular JSON parser for Node.js applications. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key __proto__ returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype.

Critical Impact

Attackers can exploit this vulnerability to achieve global prototype pollution, potentially leading to remote code execution, denial of service, or security control bypasses in applications that process untrusted JSON input through the flatted library.

Affected Products

• webreflection flatted (versions prior to 3.4.2)
• Node.js applications using the flatted package for circular JSON parsing
• Applications processing untrusted JSON data through flatted's parse() function

Discovery Timeline

• 2026-03-20 - CVE-2026-33228 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33228

Vulnerability Analysis

This vulnerability is classified under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), commonly known as Prototype Pollution. The flatted library is designed to handle circular JSON structures by using array indices as references during parsing. However, the parse() function fails to validate that index keys extracted from the JSON input are strictly numeric values.

When an attacker crafts malicious JSON input containing the string __proto__ as an array index key, the parser attempts to access the internal buffer array at that index. Due to JavaScript's prototype inheritance model, accessing array["__proto__"] returns Array.prototype instead of an array element. The parser then treats this prototype object as a legitimate value and incorporates it into the parsed output structure.

The vulnerability allows an attacker to obtain a live reference to Array.prototype through the parsed JSON result. If application code subsequently modifies properties on this reference, those modifications propagate to all Array instances in the JavaScript runtime environment. This can lead to severe consequences including arbitrary property injection, security bypass, or exploitation chains leading to remote code execution depending on how the application uses array operations.

Root Cause

The root cause lies in insufficient input validation within the parse() function. The function assumes that all index references in the serialized flatted format are numeric integers pointing to valid array positions. However, JavaScript's property access allows arbitrary string keys, and the special __proto__ key triggers prototype chain lookup rather than standard array element access. The lack of validation for numeric-only index keys allows this unintended prototype access path.

Attack Vector

The attack is network-accessible, requiring no authentication or user interaction. An attacker must be able to supply malicious JSON data to an application endpoint that processes it using flatted's parse() function. The attack flow involves:

1. The attacker crafts JSON input containing __proto__ as an index reference within the flatted format
2. The target application receives and parses this input using flatted.parse()
3. The parser accesses inputBuffer["__proto__"], inadvertently retrieving Array.prototype
4. This prototype reference becomes accessible in the parsed output object
5. Subsequent code that writes to properties on this reference pollutes the global Array.prototype

The vulnerability mechanism exploits JavaScript's prototype inheritance model. When the internal buffer array is accessed with the __proto__ key, the JavaScript engine returns Array.prototype through the inherited getter. This behavior is fundamental to JavaScript but becomes dangerous when attacker-controlled input determines property access keys without proper sanitization. See the GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2026-33228

Indicators of Compromise

• Unexpected properties appearing on JavaScript Array.prototype or Object.prototype in application runtime
• Application crashes or unexpected behavior related to array operations after processing external JSON data
• Log entries showing JSON payloads containing __proto__, constructor, or prototype string values in unusual positions
• Memory analysis revealing modified prototype chains in Node.js process dumps

Detection Strategies

• Implement dependency scanning to identify flatted versions prior to 3.4.2 in package.json and package-lock.json files
• Deploy runtime application security monitoring to detect prototype pollution attempts through unusual property access patterns
• Configure web application firewalls to inspect JSON payloads for prototype pollution keywords like __proto__ and constructor.prototype
• Use static analysis tools to identify code paths where untrusted JSON is processed through flatted without prior sanitization

Monitoring Recommendations

• Enable detailed logging for all JSON parsing operations in applications using flatted to capture malicious input attempts
• Monitor Node.js application error logs for TypeError exceptions that may indicate prototype pollution side effects
• Implement anomaly detection for unexpected object property access patterns in production environments
• Track dependency update deployments to ensure timely patching of vulnerable flatted versions

How to Mitigate CVE-2026-33228

Immediate Actions Required

• Upgrade flatted to version 3.4.2 or later immediately in all affected applications
• Audit application code to identify all locations where flatted processes untrusted input
• Implement input validation layers to sanitize JSON data before passing to flatted's parse() function
• Review application logs for evidence of exploitation attempts using __proto__ injection patterns

Patch Information

The vulnerability has been patched in flatted version 3.4.2. The fix adds validation to ensure that array index keys are strictly numeric before using them to access the internal buffer. The security patch is available in GitHub Commit 885ddcc. Users should update their dependencies by running npm or yarn update commands to pull the latest patched version from the official release.

Workarounds

• Implement a JSON preprocessing layer that recursively removes or escapes __proto__, constructor, and prototype keys before parsing
• Use Object.freeze(Array.prototype) and Object.freeze(Object.prototype) to prevent prototype modifications at application startup, though this may cause compatibility issues with some libraries
• Deploy application-level input validation to reject JSON payloads containing known prototype pollution vectors
• Consider alternative circular JSON libraries that implement prototype pollution protections if immediate upgrade is not feasible

# Update flatted to patched version
npm update flatted@^3.4.2

# Or install specific patched version
npm install flatted@3.4.2

# Verify installed version
npm list flatted