parse-nested-form-data, a Node.js library that parses FormData into nested objects, has a prototype pollution flaw. Before version 1.0.1 the parser does not filter reserved property names, so a field beginning with __proto__ or containing .__proto__ causes Object.prototype to be extended. All plain objects in the process inherit those properties, compromising code that relies on the default prototype chain.

The module milamer/parse-nested-form-data is affected. All releases older than version 1.0.1 are vulnerable. The flaw appears when a FormData field name begins with __proto__ or contains .__proto__ mid-path. Upgrading to v1.0.1 removes the issue.

The CVSS score is 8.2 indicating high severity. EPSS score is not available, and the lack of a KEV listing suggests no publicly known exploits yet. If an attacker can supply FormData to the vulnerable application the route can be exploited remotely, with significant impact on application integrity.