{"id":"CVE-2026-33228","aliases":["AZL-80309","CLSA-2026-1776299659","CLSA-2026-1779410883","CLSA-2026-1781830591","CLSA-2026-1781830592","CLSA-2026-1781830593","CLSA-2026-1791278813","DEBIAN-CVE-2026-33228","EUVD-2026-13881","GHSA-rf6f-7fwh-wjgh","ROOT-APP-NPM-CVE-2026-33228","UBUNTU-CVE-2026-33228"],"status":"published","title":"flatted: Prototype Pollution via parse()","description":"flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key \"__proto__\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.","severity":{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00856,"percentile":0.58708,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-915"],"published":"2026-03-19T17:43:54Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"flatted","fixed_in":["3.4.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"flatted","fixed_in":["2.0.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-flatted","fixed_in":["3.2.7~ds-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-flatted","fixed_in":["3.4.2~ds-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"flatted","fixed_in":["3.3.1-aikido.3","3.4.1-aikido.2","3.3.3-aikido.3","2.0.2-aikido.2","3.3.2-aikido.4","3.2.7-aikido.2","3.2.5-aikido.1","3.2.9-aikido.2","3.2.7-aikido.1","3.2.2-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/flatted","fixed_in":["3.3.1-root.io.2","3.3.3-root.io.2","3.3.2-root.io.3","3.4.1-root.io.1","2.0.2-root.io.1","3.3.1-root.io.3","3.4.1-root.io.2","3.3.3-root.io.3","2.0.2-root.io.2","3.3.2-root.io.4","3.2.7-root.io.2","3.2.5-root.io.1","3.2.9-root.io.2","3.2.7-root.io.1","3.2.2-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.4.1"},{"fixed":"3.4.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.2-tuxcare.0"},{"fixed":"2.0.2-tuxcare.1"}]}],"versions":["2.0.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.3-tuxcare.0"},{"fixed":"3.3.3-tuxcare.1"}]}],"versions":["3.3.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.9-tuxcare.0"},{"fixed":"3.2.9-tuxcare.1"}]}],"versions":["3.2.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.2-tuxcare.0"},{"fixed":"3.3.2-tuxcare.1"}]}],"versions":["3.3.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.1-tuxcare.0"},{"fixed":"3.3.1-tuxcare.1"}]}],"versions":["3.3.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-tuxcare.0"},{"fixed":"2.0.0-tuxcare.1"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"Debian:12","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.7~ds-1","3.2.7~ds-1+deb12u1","3.4.1~ds-1","3.4.2~ds-1","3.4.4~ds-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7~ds-1+deb13u1"}]}],"versions":["3.2.7~ds-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2~ds-1"}]}],"versions":["3.2.7~ds-1","3.4.1~ds-1"]},{"source":"osv","ecosystem":"npm","package":"flatted","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-aikido.3"},{"fixed":"3.4.1-aikido.2"},{"fixed":"3.3.3-aikido.3"},{"fixed":"2.0.2-aikido.2"},{"fixed":"3.3.2-aikido.4"},{"fixed":"3.2.7-aikido.2"},{"fixed":"3.2.5-aikido.1"},{"fixed":"3.2.9-aikido.2"},{"fixed":"3.2.7-aikido.1"},{"fixed":"3.2.2-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-root.io.2"},{"fixed":"3.3.3-root.io.2"},{"fixed":"3.3.2-root.io.3"},{"fixed":"3.4.1-root.io.1"},{"fixed":"2.0.2-root.io.1"},{"fixed":"3.3.1-root.io.3"},{"fixed":"3.4.1-root.io.2"},{"fixed":"3.3.3-root.io.3"},{"fixed":"2.0.2-root.io.2"},{"fixed":"3.3.2-root.io.4"},{"fixed":"3.2.7-root.io.2"},{"fixed":"3.2.5-root.io.1"},{"fixed":"3.2.9-root.io.2"},{"fixed":"3.2.7-root.io.1"},{"fixed":"3.2.2-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1~dfsg-3","2.0.1~dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.2~dfsg-1","2.0.2~dfsg-4","3.2.2~ds-2","3.2.2~ds-3","3.2.4~ds-1","3.2.5~ds-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.7~ds-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.7~ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.2~ds-1","3.4.4~ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-flatted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.7~ds-1","3.4.2~ds-1"]}],"products":[{"vendor":"red hat","product":"cluster observability operator 1.5.0"},{"vendor":"red hat","product":"cryostat 4"},{"vendor":"red hat","product":"logging subsystem for red hat openshift"},{"vendor":"red hat","product":"multicluster engine for kubernetes"},{"vendor":"red hat","product":"red hat 3scale api management platform 2"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2"},{"vendor":"red hat","product":"red hat amq broker 7"},{"vendor":"red hat","product":"red hat build of apicurio registry 2"},{"vendor":"red hat","product":"red hat build of keycloak"},{"vendor":"red hat","product":"red hat build of optaplanner 8"},{"vendor":"red hat","product":"red hat build of podman desktop"},{"vendor":"red hat","product":"red hat data grid 8"},{"vendor":"red hat","product":"red hat developer hub 1.8"},{"vendor":"red hat","product":"red hat developer hub 1.9"},{"vendor":"red hat","product":"red hat directory server 11"},{"vendor":"red hat","product":"red hat directory server 12"},{"vendor":"red hat","product":"red hat directory server 13"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"red hat quay 3"},{"vendor":"red hat","product":"red hat single sign-on 7"},{"vendor":"red hat","product":"streams for apache kafka 2"},{"vendor":"red hat","product":"streams for apache kafka 3"},{"vendor":"webreflection","product":"flatted"}],"references":[{"url":"https://github.com/WebReflection/flatted/security/advisories/GHSA-rf6f-7fwh-wjgh","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/WebReflection/flatted/releases/tag/v3.4.2","tags":["x_refsource_MISC","Product","web","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33228","tags":["vdb-entry","x_refsource_REDHAT","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449872","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33228.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34342","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9742","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13826","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33228","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-rf6f-7fwh-wjgh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33228.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-33228","tags":["advisory"]},{"url":"https://github.com/WebReflection/flatted","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-33228","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33228","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-33228","title":"flatted: Prototype Pollution via parse()","description":"flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key \"__proto__\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.","status":"published","published":"2026-03-20T23:06:48.485Z","modified":"2026-09-07T12:05:12.907Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-1321","CWE-915"],"updated_at":"2026-11-02T14:20:08.009733Z"}],"euvd":[{"id":"EUVD-2026-13881","description":"flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key \"__proto__\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.","status":"published","published":"2026-03-20T23:06:48Z","modified":"2026-09-07T12:05:12Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"updated_at":"2026-11-02T17:28:30.668645Z"}],"ghsa":[{"id":"GHSA-rf6f-7fwh-wjgh","title":"Prototype Pollution via parse() in NodeJS flatted","description":"---\n  **Summary**\n\n  The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index\n  keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it\n  with the key \"\\_\\_proto\\_\\_\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate\n   parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype\n   to the consumer. Any code that subsequently writes to that property will pollute the global prototype.\n\n  ---\n  **Root Cause**\n\n  File: esm/index.js:29 (identical in cjs/index.js)\n```\n  const resolver = (input, lazy, parsed, $) =\u003e output =\u003e {\n    for (let ke = keys(output), {length} = ke, y = 0; y \u003c length; y++) {\n      const k = ke[y];\n      const value = output[k];    \n      if (value instanceof Primitive) {\n        const tmp = input[value];      // Bug is here\n```\n\nNo validation that value is a safe numeric index input is built as a plain Array. JavaScript's property lookup on arrays traverses the prototype chain for non-numeric  keys. The key \"\\_\\_proto\\_\\_\" resolves to Array.prototype, which:\n\n  - has type \"object\" → passes the typeof tmp === object guard at line 30\n  - is not in the parsed Set yet → passes the !parsed.has(tmp) guard.\n  - The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.\n  ---\n  **Replication Steps**\n```\n  const Flatted = require('flatted'); \n  const parsed = Flatted.parse('[{\"x\":\"__proto__\"}]');\n  parsed.x.polluted = 'pwned';\n  console.log([].polluted);  // Returns true\n``` \n ---\n  **Impact**\n An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.\n\n  **Recommended solution**\n Validate that the index string represents an integer within the bounds of input before accessing it:\n\n  // Before (vulnerable)\n  const tmp = input[value];\n\n  // After (safe)\n  const idx = +value;  // coerce boxed String → number\n  const tmp = (Number.isInteger(idx) \u0026\u0026 idx \u003e= 0 \u0026\u0026 idx \u003c input.length)\n    ? input[idx]\n    : undefined;","status":"published","published":"2026-03-19T17:43:54Z","modified":"2026-10-05T15:48:47Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-915","CWE-1321"],"updated_at":"2026-11-02T14:41:25.889593Z"}],"nvd":[{"id":"CVE-2026-33228","description":"flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key \"__proto__\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.","status":"published","published":"2026-03-20T23:16:46.51Z","modified":"2026-09-04T13:18:55.12Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-1321","CWE-915"],"updated_at":"2026-11-02T14:12:10.126802Z"}],"osv":[{"id":"CVE-2026-33228","title":"flatted: Prototype Pollution via parse()","description":"flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key \"__proto__\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.","status":"published","published":"2026-03-20T23:06:48.485Z","modified":"2026-10-28T02:30:23.594448501Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"DEBIAN-CVE-2026-33228","description":"flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key \"__proto__\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.","status":"published","published":"2026-03-20T23:16:46.51Z","modified":"2026-10-01T03:03:10.841807709Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"GHSA-rf6f-7fwh-wjgh","title":"Prototype Pollution via parse() in NodeJS flatted","description":"---\n  **Summary**\n\n  The parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index\n  keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it\n  with the key \"\\_\\_proto\\_\\_\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate\n   parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype\n   to the consumer. Any code that subsequently writes to that property will pollute the global prototype.\n\n  ---\n  **Root Cause**\n\n  File: esm/index.js:29 (identical in cjs/index.js)\n```\n  const resolver = (input, lazy, parsed, $) =\u003e output =\u003e {\n    for (let ke = keys(output), {length} = ke, y = 0; y \u003c length; y++) {\n      const k = ke[y];\n      const value = output[k];    \n      if (value instanceof Primitive) {\n        const tmp = input[value];      // Bug is here\n```\n\nNo validation that value is a safe numeric index input is built as a plain Array. JavaScript's property lookup on arrays traverses the prototype chain for non-numeric  keys. The key \"\\_\\_proto\\_\\_\" resolves to Array.prototype, which:\n\n  - has type \"object\" → passes the typeof tmp === object guard at line 30\n  - is not in the parsed Set yet → passes the !parsed.has(tmp) guard.\n  - The reference to Array.prototype is then enqueued in lazy and later unconditionally assigned to the output object.\n  ---\n  **Replication Steps**\n```\n  const Flatted = require('flatted'); \n  const parsed = Flatted.parse('[{\"x\":\"__proto__\"}]');\n  parsed.x.polluted = 'pwned';\n  console.log([].polluted);  // Returns true\n``` \n ---\n  **Impact**\n An attacker can supply a crafted flatted string to parse() that causes the returned object to hold a live reference to Array.prototype, enabling any downstream code that writes to that property to pollute the global prototype chain, potentially causing denial of service or code execution.\n\n  **Recommended solution**\n Validate that the index string represents an integer within the bounds of input before accessing it:\n\n  // Before (vulnerable)\n  const tmp = input[value];\n\n  // After (safe)\n  const idx = +value;  // coerce boxed String → number\n  const tmp = (Number.isInteger(idx) \u0026\u0026 idx \u003e= 0 \u0026\u0026 idx \u003c input.length)\n    ? input[idx]\n    : undefined;","status":"published","published":"2026-03-19T17:43:54Z","modified":"2026-10-05T16:00:04.586755982Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-1321","CWE-915"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"ROOT-APP-NPM-CVE-2026-33228","title":"CVE-2026-33228 in flatted - Patched by Root","description":"Root has patched CVE-2026-33228 in the flatted package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-11T08:13:18Z","modified":"2026-09-11T09:15:04.59938564Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"UBUNTU-CVE-2026-33228","description":"flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key \"__proto__\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.","status":"published","published":"2026-03-20T23:16:00Z","modified":"2026-10-17T13:00:00.022615447Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"AZL-80309","title":"CVE-2026-33228 affecting package js-jquery 3.5.0-4","description":"flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key \"__proto__\" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.","status":"published","published":"2026-03-20T23:16:46Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"CLSA-2026-1776299659","title":"TuxCare security update for flatted (2 CVEs)","description":"TuxCare rebuilt flatted to address 2 CVEs. Fixed in 2.0.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:26Z","modified":"2026-10-15T09:47:49.844955283Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1779410883","title":"TuxCare security update for flatted (2 CVEs)","description":"TuxCare rebuilt flatted to address 2 CVEs. Fixed in 3.3.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:48:03.687166922Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1781830591","title":"TuxCare security update for flatted (2 CVEs)","description":"TuxCare rebuilt flatted to address 2 CVEs. Fixed in 3.2.9-tuxcare.1.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-10-15T09:45:56.800169177Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1781830592","title":"TuxCare security update for flatted (2 CVEs)","description":"TuxCare rebuilt flatted to address 2 CVEs. Fixed in 3.3.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-10-15T09:45:57.152911505Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1781830593","title":"TuxCare security update for flatted (2 CVEs)","description":"TuxCare rebuilt flatted to address 2 CVEs. Fixed in 3.3.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-10-15T09:45:51.437711797Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1791278813","title":"TuxCare security update for flatted (1 CVE)","description":"TuxCare rebuilt flatted to address 1 CVE. Fixed in 2.0.0-tuxcare.1.","status":"published","published":"2026-10-06T09:26:53Z","modified":"2026-10-15T09:47:35.611255252Z","updated_at":"2026-11-02T15:43:49.016976Z"}]}}