« Volver al listado

CVE-2026-45302

Estado: AplazadaAlta (8.2)—

parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData() walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with __proto__, or contains .__proto__. mid-path, causes the parser to traverse onto Object.prototype and assign properties there, polluting the prototype chain of every plain object in the running process. This issue has been patched in version 1.0.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de red sin autenticación (AV:N/PR:N) en módulo Node.js expuesto. Contaminación de prototipo permite manipular objetos en memoria e inyectar código arbitrario en el proceso.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationVulnerability ScanningRestrict Web-Based ContentRestrict File and Directory PermissionsLimit Software Installation

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Parse-nested-form-data — Parse-nested-form-dataAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-45302",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45302",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-02T14:44:56.480694Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "milamer",
          "product": "parse-nested-form-data",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-01T19:16:51.113",
  "references": [
    {
      "url": "https://github.com/milamer/parse-nested-form-data/commit/527ad58eb486e32438f7198fb88315c20449d792",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/milamer/parse-nested-form-data/releases/tag/v1.0.1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/milamer/parse-nested-form-data/security/advisories/GHSA-xp7r-j8r6-j9h3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/milamer/parse-nested-form-data/security/advisories/GHSA-xp7r-j8r6-j9h3",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData() walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with __proto__, or contains .__proto__. mid-path, causes the parser to traverse onto Object.prototype and assign properties there, polluting the prototype chain of every plain object in the running process. This issue has been patched in version 1.0.1."
    },
    {
      "lang": "es",
      "value": "parse-nested-form-data es un pequeño módulo de Node para analizar datos de FormData por nombre en objetos y arrays. Antes de la versión 1.0.1, parseFormData() recorre los nombres de campo de FormData con notación de corchetes y de puntos en objetos anidados sin filtrar las claves de propiedades reservadas. Un único campo de FormData cuyo nombre comienza con __proto__, o contiene .__proto__. a mitad de ruta, hace que el analizador recorra Object.prototype y asigne propiedades allí, contaminando la cadena de prototipos de cada objeto plano en el proceso en ejecución. Este problema ha sido parcheado en la versión 1.0.1."
    }
  ],
  "lastModified": "2026-07-22T08:10:00.117",
  "sourceIdentifier": "security-advisories@github.com"
}