Security Resilience

CVE-2026-45302

Published
01 June 2026
Modified
22 July 2026
CVSS Score v3.1 8.2
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
EPSS Score 0.0032 25th percentile
Risk Priority 62 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-45302 is a high-severity Prototype Pollution (CWE-1321) vulnerability. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 25th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

No EU or UK CSIRT advisories indexed for this CVE.

Vulnerability Data

parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData() walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose…

more

name begins with __proto__, or contains .__proto__. mid-path, causes the parser to traverse onto Object.prototype and assign properties there, polluting the prototype chain of every plain object in the running process. This issue has been patched in version 1.0.1.

CWE(s)
CWE-1321

Related Threats

MITRE ATT&CK Enterprise Techniques

MITRE ATT&CK v20.0

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-8083Shared CWE-1321
CVE-2026-42232Shared CWE-1321
CVE-2024-34698Shared CWE-1321
CVE-2023-26158Shared CWE-1321
CVE-2024-29650Shared CWE-1321
CVE-2026-54756Shared CWE-1321
CVE-2023-38894Shared CWE-1321
CVE-2023-26102Shared CWE-1321
CVE-2025-62410Shared CWE-1321
CVE-2025-3193Shared CWE-1321

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V15.3.6

Mitigating Controls (NIST CSF 2.0)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.

PR.PS-06 mostly match
blocks

Secure SDLC practices directly require input validation and safe property assignment to prevent prototype pollution.

Mitigating Controls (ISO/IEC 27001:2022 Annex A)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing in development catches prototype-pollution flaws before release.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly prohibit unsafe prototype attribute assignment and require defensive checks.

A.8.32 Change management partial match
blocks

Change-management processes ensure security fixes for prototype-pollution issues are tracked and deployed.

References