Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

flatted JSON parser may let attackers alter global objects

CVE-2026-33228 · published 7 months ago
Summary

Versions of the flatted library before 3.4.2 can treat specially crafted data as a request to modify the core JavaScript array prototype. This can cause unexpected behavior across your whole application if the altered prototype is later used. Update flatted to version 3.4.2 or newer to stop the issue.

What to do
  • Update webreflection flatted to version 3.4.2.
  • Update rootio @rootio/flatted to version 3.2.2-root.io.2.
  • Update webreflection flatted to version 3.2.2-aikido.2.
  • Update rootio @rootio/flatted to version 3.3.3-root.io.2.
  • Update rootio @rootio/flatted to version 3.3.2-root.io.3.
  • Update rootio @rootio/flatted to version 3.4.1-root.io.1.
  • Update rootio @rootio/flatted to version 3.3.2-root.io.4.
  • Update webreflection flatted to version 3.3.2-aikido.4.
  • Update webreflection flatted to version 3.2.5-aikido.1.
  • Update rootio @rootio/flatted to version 3.2.5-root.io.1.
  • Update webreflection flatted to version 3.2.9-aikido.2.
  • Update rootio @rootio/flatted to version 3.2.9-root.io.2.
  • Update flatted to version 3.2.2-aikido.2.
  • Update flatted to version 3.4.2.
Affected software
Ecosystem VendorProductAffected versions
npm webreflection flatted <= 3.4.1
< 3.4.2
Fix: upgrade to 3.4.2
Debian:11 debian node-flatted All versions
Debian:12 debian node-flatted All versions
Debian:13 debian node-flatted All versions
Debian:14 debian node-flatted All versions
Root:npm rootio @rootio/flatted < 3.2.2-root.io.2
< 3.3.3-root.io.2
< 3.3.2-root.io.3
< 3.4.1-root.io.1
< 3.3.2-root.io.4
< 3.2.5-root.io.1
< 3.2.9-root.io.2
Fix: upgrade to 3.2.2-root.io.2
Root:npm webreflection flatted < 3.2.2-aikido.2
< 3.3.2-aikido.4
< 3.2.5-aikido.1
< 3.2.9-aikido.2
Fix: upgrade to 3.2.2-aikido.2
– webreflection flatted < 3.4.2
Root:npm – flatted < 3.2.2-aikido.2
Fix: upgrade to 3.2.2-aikido.2
npm – flatted <= 3.4.1
< 3.4.2
Fix: upgrade to 3.4.2
Ubuntu:20.04:LTS canonical node-flatted All versions
Original advisory text
flatted: Prototype Pollution via parse()
flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-1321Prototype Pollution
CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes
Timeline
Published20 Mar 2026
Updated4 Nov 2026
First seen19 Mar 2026
Sources
DEBIAN-CVE-2026-33228 · OSV
ROOT-APP-NPM-CVE-2026-33228 · OSV
GHSA-rf6f-7fwh-wjgh · GHSA
CVE-2026-33228 · NVD
GHSA-rf6f-7fwh-wjgh · OSV
CVE-2026-33228 · MITRE
CVE-2026-33228 · OSV
UBUNTU-CVE-2026-33228 · OSV
Track software like this
Free during beta