CVE-2026-33228: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33228 is a prototype pollution vulnerability in the flatted npm package (Node.js) that allows unauthenticated attackers to corrupt the global Array.prototype by supplying a crafted JSON string to the parse() function. It affects all versions of flatted up to and including 3.4.1, with version 3.4.2 containing the fix. The vulnerability was published on March 19, 2026, by the package maintainer (WebReflection) and added to the NVD on March 20, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.9 (High) (GitHub Advisory, Flatted Security Advisory).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — Prototype Pollution). In esm/index.js (and identically in cjs/index.js) at line 29, the resolver function accesses the internal input array using an unvalidated, attacker-controlled string value: const tmp = input[value];. Because input is a plain JavaScript Array, accessing it with the non-numeric key "__proto__" traverses the prototype chain and returns Array.prototype. This object passes both the typeof tmp === 'object' guard and the !parsed.has(tmp) guard, causing a live reference to Array.prototype to be enqueued and later unconditionally assigned to the parsed output object. The fix (commit 885ddcc) coerces the index to a number before access (input[+value]), ensuring non-numeric keys resolve to undefined (Flatted Security Advisory, Fix Commit).

Successful exploitation allows an attacker to pollute Array.prototype globally within the Node.js process, meaning any subsequent code that writes to the returned object's property will affect all arrays and objects inheriting from Array.prototype. This can lead to denial of service (application crashes or unexpected behavior), arbitrary code execution if the polluted prototype properties are used in security-sensitive logic, and potential data integrity compromise across the entire application. The vulnerability is particularly dangerous in applications that accept and parse untrusted JSON input using flatted, as no authentication or special privileges are required (GitHub Advisory, Flatted Security Advisory).

A proof-of-concept exploit is publicly available in the official security advisory, demonstrating the vulnerability with a minimal, self-contained code snippet requiring no network interaction or external systems (Flatted.parse('[{"x":"__proto__"}]')). The EPSS score is approximately 0.014% (0.07% per GitHub Advisory, 21st percentile), indicating low current exploitation probability. There is no evidence of active in-the-wild exploitation or CISA KEV catalog inclusion at this time. No threat actor attribution has been reported (Flatted Security Advisory, GitHub Advisory).

1. Identify a target: Find a Node.js application that uses the flatted npm package (versions ≤ 3.4.1) and accepts user-controlled JSON input that is passed to Flatted.parse().
2. Craft a malicious payload: Construct a flatted-encoded JSON string that uses "__proto__" as an array index reference, e.g., '[{"x":"__proto__"}]'.
3. Submit the payload: Deliver the crafted string to any application endpoint or function that calls Flatted.parse() on attacker-supplied data.
4. Trigger prototype pollution: The parse() function resolves "__proto__" against the internal input array, retrieves Array.prototype, and assigns it as a property of the returned object.
5. Pollute the global prototype: Write to the returned object's property (e.g., parsed.x.polluted = 'pwned'); this modifies Array.prototype, affecting all arrays in the process — verifiable via [].polluted // 'pwned'.
6. Achieve impact: Depending on application logic, the polluted prototype can cause denial of service, bypass security checks, or enable code execution if prototype properties are used in sensitive operations (Flatted Security Advisory).

• Application Behavior: Unexpected undefined or injected property values appearing on unrelated arrays or objects within the Node.js process; application crashes or errors referencing prototype chain manipulation.
• Logs: Incoming requests or data containing the string __proto__ in JSON payloads processed by flatted; Node.js error logs showing unexpected property access on Array.prototype.
• Dependency Audit: Presence of flatted versions ≤ 3.4.1 in node_modules or package-lock.json/yarn.lock (detectable via npm audit or scanner tools such as Nessus plugin 303264 or Qualys detections).
• Network: JSON payloads in HTTP request bodies or WebSocket messages containing "__proto__" as a value in flatted-encoded format.

The primary remediation is to upgrade the flatted npm package to version 3.4.2 or later, which validates that array index strings are numeric before access (input[+value]) (Fix Commit, flatted v3.4.2 Release). As a temporary workaround if immediate patching is not possible, implement input validation to reject JSON strings containing suspicious keys such as "__proto__" before passing them to Flatted.parse(). Numerous IBM products (including IBM API Connect, Maximo Application Suite, watsonx Code Assistant, App Connect Enterprise, QRadar Suite, and others) have released or are releasing security bulletins addressing this dependency; affected IBM product users should apply the relevant IBM security patches (IBM watsonx Code Assistant, IBM API Connect, IBM Maximo Monitor).

IBM issued multiple security bulletins across its product portfolio (API Connect, Maximo Application Suite, watsonx, App Connect Enterprise, QRadar Suite, Instana, and others) acknowledging the vulnerability in their flatted dependencies, with patch dates ranging from April to June 2026 (IBM App Connect Enterprise, IBM Maximo Monitor). Heise (German tech media) covered the vulnerability in the context of IBM App Connect Enterprise security updates (Heise). Red Hat issued errata (RHSA-2026:9742 and RHSA-2026:13826) addressing the vulnerability in their affected packages. The vulnerability was also picked up by Tenable (Nessus plugin 303264) and Qualys for automated detection.