CVE-2026-55091: 
JavaScript vulnerability analysis and mitigation

CVE-2026-55091 is a prototype pollution vulnerability in the flat-to-nested npm package (versions ≤ 1.1.1) that allows unauthenticated remote attackers to pollute Object.prototype by passing a crafted record with parent set to "__proto__" to the convert() function. The vulnerability was discovered and reported by security researcher moizxsec, published by the maintainer on June 16, 2026, and added to the GitHub Advisory Database on June 19, 2026. The patched version is 1.1.2. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Repo Advisory).

The root cause is classified under CWE-915 and CWE-1321 — improperly controlled modification of object prototype attributes. In index.js, the convert() method initializes temp and pendingChildOf as plain {} objects (lines 45–46), which inherit from Object.prototype. The parent field of each input record is taken verbatim (line 51) and used as a dynamic key: when parent === "__proto__", temp["__proto__"] resolves via the prototype chain to Object.prototype itself (which is !== undefined), causing the subsequent initPush() call to write attacker-controlled data directly onto the global prototype (e.g., Object.prototype["children"] = [{ id: 1, polluted: 'PWNED' }]). The pollution is stealthy because existing prototype methods such as toString remain intact. A public PoC is included in the advisory: new FlatToNested().convert([{ id: 1, parent: '__proto__', polluted: 'PWNED' }]) results in ({}).children being set on every subsequently created object (GitHub Advisory, Repo Advisory).

Successful exploitation pollutes Object.prototype globally within the Node.js process, meaning every plain object created after the attack inherits attacker-controlled properties. Consequences range from application-logic corruption and denial of service to potential privilege escalation or remote code execution if downstream code uses polluted prototype properties as gadgets (e.g., in template engines, eval-adjacent sinks, or security checks). No confidentiality impact is scored, but integrity is rated High due to the ability to silently alter the behavior of all objects in the runtime. Any service that processes attacker-influenced flat records — such as those derived from database queries, REST APIs, or user input — is at risk (GitHub Advisory).

A working proof-of-concept is publicly available in the GitHub Security Advisory, requiring no authentication, no special privileges, and no user interaction. The CVE status is listed as "Reserved" and no in-the-wild exploitation has been reported as of the advisory date. No CISA KEV catalog entry or threat actor attribution is currently associated with this vulnerability. The attack vector is network-accessible in any application that exposes an endpoint accepting flat record data passed to convert() (GitHub Advisory, Repo Advisory).

1. Identify target: Find a Node.js application that uses flat-to-nested ≤ 1.1.1 and passes user-controlled or externally influenced data (e.g., from a REST API body, database query result, or form input) to FlatToNested.convert().
2. Craft malicious payload: Construct a flat record array where one record has its parent field set to the string "__proto__" and includes attacker-chosen properties: [{ id: 1, parent: '__proto__', polluted: 'PWNED' }].
3. Submit payload: Deliver the crafted record array to the application via the relevant input channel (e.g., HTTP POST body, query parameter, or database-injected value) so it reaches the convert() call.
4. Trigger prototype pollution: When convert() processes the record, temp["__proto__"] resolves to Object.prototype, and initPush() writes the attacker's data onto the global prototype, setting Object.prototype["children"] to an array containing the malicious record.
5. Exploit downstream gadgets: Leverage the polluted prototype property in downstream application logic — for example, bypassing security checks that rely on property existence, corrupting template rendering, or triggering RCE via gadget chains in frameworks like Lodash-dependent code or server-side template engines (GitHub Advisory, Repo Advisory).

• Logs: Unexpected application behavior or errors following processing of records containing "__proto__", "constructor", or "prototype" as field values in API request logs or application logs.
• Application Behavior: Newly created plain objects ({}) unexpectedly carrying properties such as children, polluted, or other attacker-chosen keys — detectable via runtime assertions or monitoring hooks on Object.prototype.
• Network: HTTP requests to endpoints that accept hierarchical/tree-building data containing JSON fields with "parent": "__proto__" or "id": "__proto__" values.
• Process: Anomalous downstream behavior such as unexpected privilege changes, template rendering errors, or security bypass events occurring after flat-record processing in Node.js services (GitHub Advisory).

Upgrade flat-to-nested to version 1.1.2, which fixes the vulnerability by replacing temp = {} and pendingChildOf = {} with Object.create(null) — prototype-less maps that prevent __proto__, constructor, and prototype from resolving via the prototype chain. As a temporary workaround if upgrading is not immediately possible, sanitize all input records before passing them to convert() by rejecting or renaming any id or parent values equal to "__proto__", "constructor", or "prototype". Developers can also apply the fix manually by patching index.js lines 45–46 as shown in the upstream commit (Patch Commit, GitHub Advisory).

The vulnerability was reported by security researcher moizxsec, who also provided the patch and regression tests. The fix was merged by the maintainer (joaonuno) promptly after disclosure. No significant broader media coverage or notable community commentary beyond the GitHub advisory thread has been identified at this time (Repo Advisory).