CVE-2026-55091: flat-to-nested Prototype Pollution DoS Flaw

CVE-2026-55091 Overview

CVE-2026-55091 is a prototype pollution vulnerability in the flat-to-nested Node.js package, which converts hierarchical data from a flat representation to a nested one. Versions prior to 1.1.2 allow attacker-influenced id and parent fields to be used directly as keys in internal lookup objects. When these fields contain values like __proto__, constructor, or prototype, the library writes attacker-controlled data to Object.prototype, polluting inherited state across all objects in the application. The issue is fixed in version 1.1.2.

Critical Impact
Any application that passes attacker-influenced flat records to FlatToNested.prototype.convert() can suffer application-logic corruption, denial of service, or escalated impact when a downstream prototype-pollution gadget is present.

Affected Products

flat-to-nested npm package versions prior to 1.1.2
Node.js applications that pass user-controlled records to convert()
Downstream libraries and services that depend on flat-to-nested

Discovery Timeline

2026-09-14 - CVE-2026-55091 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-55091

Vulnerability Analysis

The vulnerability resides in FlatToNested.prototype.convert within index.js. The function builds two lookup tables, temp and pendingChildOf, using plain object literals ({}). It then reads id and parent values directly from input records and uses them as keys against these tables. Because plain objects inherit from Object.prototype, indexing with the string __proto__ returns the prototype itself rather than an own property.

When the internal initPush() helper writes to a children property on the resolved object, it mutates Object.prototype.children globally. Every object in the JavaScript runtime then inherits this attacker-controlled children field. The strings constructor and prototype are unsafe inherited keys in the same design and can be abused through the identical lookup path. This class of flaw is tracked as [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes].

Root Cause

The root cause is the use of prototype-inheriting objects as key-value maps for untrusted input. Because temp and pendingChildOf inherit from Object.prototype, any lookup with a prototype-reserved name resolves to a shared runtime object rather than an isolated map entry.

Attack Vector

An attacker supplies a flat record where id or parent equals __proto__, constructor, or prototype. When the application calls convert() on this record, initPush() writes a children array onto Object.prototype. Downstream code that checks for a children property on unrelated objects will observe the polluted value, corrupting logic or triggering denial of service. Network-reachable applications that accept JSON input and forward it to convert() are exploitable without authentication.

javascript

     var i, len, temp, roots, id, parent, nested, pendingChildOf, flatEl;
     i = 0;
     roots = [];
-    temp = {};
-    pendingChildOf = {};
+    // Use prototype-less maps for the id/parent lookup tables. `id` and
+    // `parent` come straight from input records and are used as object keys,
+    // so a plain `{}` lets a record with `parent === '__proto__'` resolve
+    // `temp[parent]` to `Object.prototype` and pollute the global prototype
+    // via initPush. `Object.create(null)` has no inherited keys, so
+    // `__proto__`/`constructor`/`prototype` are ordinary (harmless) own keys.
+    temp = Object.create(null);
+    pendingChildOf = Object.create(null);
 
     for (i, len = flat.length; i < len; i++) {
       flatEl = flat[i];

Source: GitHub Commit 680a5eb

Detection Methods for CVE-2026-55091

Indicators of Compromise

Inbound HTTP or API payloads containing JSON fields with values __proto__, constructor, or prototype in id or parent positions.
Unexpected children properties appearing on plain objects at runtime, particularly on objects that were never assigned a children field.
Application errors or hangs following ingestion of tree-shaped input from external sources.

Detection Strategies

Perform software composition analysis to identify flat-to-nested versions below 1.1.2 in package.json and package-lock.json manifests.
Deploy web application firewall rules that flag request bodies containing prototype-reserved key names in structured tree data.
Enable Node.js runtime instrumentation to detect writes to Object.prototype during request handling.

Monitoring Recommendations

Log and alert on 5xx error spikes correlated with hierarchical data ingestion endpoints.
Monitor dependency inventories continuously through a Software Bill of Materials (SBOM) pipeline for vulnerable library versions.
Capture and review request payloads that include reserved JavaScript property names in user-controlled positions.

How to Mitigate CVE-2026-55091

Immediate Actions Required

Upgrade flat-to-nested to version 1.1.2 or later across all Node.js projects and container images.
Audit application code paths that forward untrusted input to FlatToNested.prototype.convert() and add key filtering before the call.
Rebuild and redeploy any services that bundle the vulnerable library, including lambdas and serverless workers.

Patch Information

The fix is available in flat-to-nested v1.1.2. The patch replaces the vulnerable {} lookup tables with Object.create(null), producing prototype-less maps where reserved names become harmless own keys. Full technical context is documented in GHSA-hp36-v28f-w3r4.

Workarounds

Sanitize incoming records to reject any object where id or parent equals __proto__, constructor, or prototype before invoking convert().
Freeze Object.prototype at application startup using Object.freeze(Object.prototype) to block prototype writes at runtime.
Validate tree input against a strict JSON schema that constrains id and parent to expected value formats.

bash

# Upgrade to the patched release
npm install flat-to-nested@1.1.2

# Verify the resolved version
npm ls flat-to-nested