CVE-2026-45302: parse-nested-form-data Privilege Escalation

CVE-2026-45302 Overview

CVE-2026-45302 is a prototype pollution vulnerability in parse-nested-form-data, a Node.js module that parses FormData field names into nested objects and arrays. The parseFormData() function walks bracket and dot-notation field names without filtering reserved property keys. A single FormData field whose name begins with __proto__, or contains .__proto__. mid-path, causes the parser to traverse onto Object.prototype and assign properties there. This pollutes the prototype chain of every plain object in the running Node.js process. Maintainers patched the issue in version 1.0.1 by rejecting reserved keys with a ForbiddenKeyError. The flaw is tracked under [CWE-1321] (Improperly Controlled Modification of Object Prototype Attributes).

Critical Impact
Unauthenticated attackers can submit crafted FormData payloads to pollute Object.prototype, enabling integrity tampering, authorization bypass, and denial of service across the affected Node.js process.

Affected Products

parse-nested-form-data Node.js module versions prior to 1.0.1
Any Node.js application invoking parseFormData() on attacker-controlled FormData input
Downstream packages and services bundling vulnerable versions of parse-nested-form-data

Discovery Timeline

2026-06-01 - CVE-2026-45302 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-45302

Vulnerability Analysis

The parseFormData() function converts flat FormData field names into nested JavaScript structures. Names such as user[profile][name] or user.profile.name are walked one segment at a time, with each segment used as a property key on the in-progress target object. The parser performs no validation against reserved JavaScript property names. When a segment equals __proto__, accessing that property on a plain object returns Object.prototype itself. Subsequent assignments therefore write to the global prototype rather than to a per-request object.

Root Cause

The traversal logic treats every path segment as a normal string key. JavaScript exposes __proto__, constructor, and prototype as inherited accessors on every plain object, so naive bracket-walk parsers reach Object.prototype without explicit recursion. The fix introduces a FORBIDDEN_OBJECT_KEYS set containing these three identifiers and throws ForbiddenKeyError when any path segment matches. Rejection occurs regardless of whether pollution would actually occur, keeping input unambiguous.

Attack Vector

An unauthenticated remote attacker submits a multipart form request to any endpoint that calls parseFormData(). A field named __proto__.polluted or nested.__proto__.isAdmin is sufficient. Once Object.prototype is mutated, every plain object in the process inherits the injected property. Attackers use this to bypass authorization checks that read default values, override security flags, trigger denial of service through unexpected property lookups, or chain into remote code execution where downstream code uses polluted properties in dangerous sinks.

typescript

// Patch excerpt from src/index.ts in commit 527ad58
export class ForbiddenKeyError extends Error {
  key: string
  constructor(key: string) {
    super(`Forbidden key at path part ${key}`)
    this.key = key
  }
}

const FORBIDDEN_OBJECT_KEYS = new Set(['__proto__', 'constructor', 'prototype'])

// Example trigger
// const formData = new FormData()
// formData.append('__proto__.polluted', 'yes')
// parseFormData(formData) // throws ForbiddenKeyError('__proto__')

Source: GitHub Commit 527ad58

Detection Methods for CVE-2026-45302

Indicators of Compromise

HTTP multipart requests containing field names with the substrings __proto__, constructor, or prototype
Application logs showing ForbiddenKeyError exceptions after upgrading to version 1.0.1
Unexpected properties appearing on objects that were instantiated as empty ({}) at runtime
Authorization or feature-flag checks returning truthy values for users who never had those properties set

Detection Strategies

Inspect inbound multipart form bodies for reserved key tokens using a web application firewall or reverse proxy rule
Audit running Node.js processes for the installed version of parse-nested-form-data using npm ls parse-nested-form-data
Add runtime assertions that Object.prototype contains no enumerable own properties beyond the defaults
Review software composition analysis output for transitive dependencies pulling in vulnerable versions

Monitoring Recommendations

Log and alert on parser exceptions, especially ForbiddenKeyError, to surface active exploitation attempts
Forward application and proxy logs to a centralized analytics platform and query for __proto__ in form field names
Track dependency manifests in CI to detect downgrade or pinning to vulnerable releases
Monitor for anomalous privilege elevations or feature toggles that correlate with form submission spikes

How to Mitigate CVE-2026-45302

Immediate Actions Required

Upgrade parse-nested-form-data to version 1.0.1 or later in all production and development environments
Rebuild and redeploy any container images or serverless bundles that include the vulnerable module
Review server logs for prior requests containing __proto__, constructor, or prototype in form field names
Audit application code for downstream sinks that rely on default object properties for security decisions

Patch Information

The fix is published in GitHub Release v1.0.1. The remediation commit 527ad58 adds a FORBIDDEN_OBJECT_KEYS allowlist and throws ForbiddenKeyError when a path segment matches __proto__, constructor, or prototype. Full details are documented in GHSA-xp7r-j8r6-j9h3.

Workarounds

Reject HTTP requests at the edge when form field names contain __proto__, constructor, or prototype
Wrap parseFormData() calls in a validator that pre-screens field name segments before parsing
Freeze Object.prototype early in application startup with Object.freeze(Object.prototype) to prevent runtime mutation
Use null-prototype objects (Object.create(null)) for sensitive lookup tables to break the inheritance chain

bash

# Upgrade to the patched release
npm install parse-nested-form-data@^1.0.1

# Verify the resolved version across the dependency tree
npm ls parse-nested-form-data

# Optional runtime hardening in your entry file
node -e "Object.freeze(Object.prototype); require('./server.js')"