CVE-2026-45302: Prototype Pollution in parse-nested-form-data via `__proto__` in FormData field names

Synopsis

Prototype pollution in the parse-nested-form-data Node.js module allows an unauthenticated remote attacker to corrupt the shared Object.prototype of the running process. The parser does not filter reserved property keys such as __proto__ when walking bracket or dot-notation FormData field names, so a single crafted HTTP form submission is enough to trigger the corruption. Successful exploitation lets the attacker tamper with application logic, inject unexpected properties into every plain object in the process, and may cause partial service disruption. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable parser is exposed over the network; an attacker can send a crafted FormData HTTP request from anywhere on the internet without needing LAN or physical access.

• AuthenticationNot required

  No account or credential is needed; the malicious FormData field can be submitted by any unauthenticated HTTP client.

• Victim interactionNot required

  No user action is required; the attacker sends the request directly to the service endpoint without any social engineering.

• Attack complexityDetail

  The exploit is reliable and condition-free: placing __proto__ in a FormData field name is sufficient to trigger prototype pollution with no race conditions or special environmental setup.

Blast Radius

• Injects arbitrary properties onto Object.prototype, silently changing the behavior of every plain object created in the same Node.js process for the lifetime of that process.
• Overwrites or spoofs application-logic properties (such as role flags, feature toggles, or configuration keys) in code that reads from plain objects without hasOwnProperty guards.
• Causes partial service disruption if injected properties break assumptions in framework internals or third-party libraries, leading to unhandled exceptions or degraded request handling.