Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.9

flatted library can leak prototype and allow data tampering

CVE-2026-33228 · published 6 months ago
Summary

The flatted JSON parser (versions before 3.4.2) can expose the core array prototype when it processes specially crafted data, letting an attacker modify global objects. This could affect any application that uses flatted, including the Debian and RootIO packages. Upgrade to version 3.4.2 or later to stop the issue.

What to do
  • Update webreflection flatted to version 3.4.2.
  • Update rootio @rootio/flatted to version 3.2.2-root.io.2.
  • Update webreflection flatted to version 3.2.2-aikido.2.
  • Update rootio @rootio/flatted to version 3.3.3-root.io.2.
  • Update rootio @rootio/flatted to version 3.3.2-root.io.3.
  • Update rootio @rootio/flatted to version 3.4.1-root.io.1.
  • Update rootio @rootio/flatted to version 3.3.2-root.io.4.
  • Update webreflection flatted to version 3.3.2-aikido.4.
  • Update webreflection flatted to version 3.2.5-aikido.1.
  • Update rootio @rootio/flatted to version 3.2.5-root.io.1.
  • Update webreflection flatted to version 3.2.9-aikido.2.
  • Update rootio @rootio/flatted to version 3.2.9-root.io.2.
  • Update flatted to version 3.2.2-aikido.2.
Affected software
Ecosystem VendorProductAffected versions
npm webreflection flatted <= 3.4.1
< 3.4.2
Fix: upgrade to 3.4.2
Debian:11 debian node-flatted All versions
Debian:12 debian node-flatted All versions
Debian:13 debian node-flatted All versions
Debian:14 debian node-flatted All versions
Root:npm rootio @rootio/flatted < 3.2.2-root.io.2
< 3.3.3-root.io.2
< 3.3.2-root.io.3
< 3.4.1-root.io.1
< 3.3.2-root.io.4
< 3.2.5-root.io.1
< 3.2.9-root.io.2
Fix: upgrade to 3.2.2-root.io.2
Root:npm webreflection flatted < 3.2.2-aikido.2
< 3.3.2-aikido.4
< 3.2.5-aikido.1
< 3.2.9-aikido.2
Fix: upgrade to 3.2.2-aikido.2
– webreflection flatted < 3.4.2
Root:npm – flatted < 3.2.2-aikido.2
Fix: upgrade to 3.2.2-aikido.2
Original advisory text
CVE-2026-33228 in flatted - Patched by Root
flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.
References
Severity
8.9 High
CVSS 4.0: 8.9 (GHSA)
CVSS 4.0: 9.9 (OSV)
Exploitation
EPSS <1%
Type
CWE-1321Prototype Pollution
CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes
Timeline
Published20 Mar 2026
Updated25 Sep 2026
First seen19 Mar 2026
Sources
DEBIAN-CVE-2026-33228 · OSV
ROOT-APP-NPM-CVE-2026-33228 · OSV
GHSA-rf6f-7fwh-wjgh · GHSA
CVE-2026-33228 · NVD
GHSA-rf6f-7fwh-wjgh · OSV
CVE-2026-33228 · MITRE
CVE-2026-33228 · OSV
Track software like this
Free during beta