Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the parse-nested-form-data library, where the parseFormData function processes form data without properly sanitizing the field names. The internal function handlePathPart is called to process segments of the field name paths. Prior to the patch, handlePathPart did not validate against reserved property keys such as __proto__, constructor, or prototype. When a form field with a name containing one of these keys (e.g., __proto__.polluted) was processed, handlePathPart would use the forbidden key to access an object's property. This would resolve to the object's prototype (Object.prototype), and subsequent parts of the path would be used to assign new properties to Object.prototype. This pollutes the prototype for all objects within the application, potentially leading to altered control flow, denial of service, or other unexpected behavior. The patch mitigates this by adding a check at the beginning of handlePathPart to throw an error if any of these forbidden keys are detected.
parseFormDatasrc/index.ts
handlePathPartsrc/index.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| parse-nested-form-data | npm | <= 1.0.0 | 1.0.1 |