Prototype Pollution in Milamer Parse-Nested-Form-Data
CVE-2026-45302
parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData() walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with __proto__, or contains .__proto__. mid-path, causes the parser to traverse onto Object.prototype and assign properties there, polluting the prototype chain of every plain object in the running process. This issue has been patched in version 1.0.1.
Vulnerability class: Prototype Pollution
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L.
EPSS exploit prediction
EPSS: 0.006 (44.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 44.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.006 · change: +0.002
Affected products
- Milamer Parse-Nested-Form-Data — versions < 1.0.1
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-45302?
- CVE-2026-45302 is a high-severity vulnerability in Milamer Parse-Nested-Form-Data, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 8.2/10. Published 2026-06-01.
- How severe is CVE-2026-45302?
- High severity. CVSS v3 base score is 8.2 out of 10.