CVE-2026-55091High· 7.5▾ Twilightflat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
0.4% → 0.5%
Last analysed / modified upstream
flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is proto, temp[parent] can resolve to Object.prototype, and initPush() can write attacker-controlled data to the global children prototype property while existing prototype methods remain intact. Any application that passes attacker-influenced flat records to convert() can therefore expose unrelated objects to polluted inherited state, causing application-logic corruption or denial of service and potentially enabling greater impact when a downstream prototype-pollution gadget is present. The constructor and prototype strings are also unsafe inherited-key values in the same lookup design. This issue is fixed in version 1.1.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
flat-to-nested <= 1.1.1Patched in:
flat-to-nested 1.1.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104852High· 8.2GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas
CVE-2026-103918Medium· 6.5oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards
CVE-2026-104848Critical· 9.5Tinypool is a minimal Node.js worker thread pool implementation
CVE-2026-104183Medium· 5.1stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint
CVE-2026-101909High· 8.3Axios is a promise-based HTTP client for the browser and Node.js
CVE-2026-101904Medium· 6.9Axios is a promise-based HTTP client for the browser and Node.js