CVE-2026-45302

parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with...

CVE-2026-45302: Improperly Controlled Modification of Object Prototype Attributes

parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData walks bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. A single FormData field whose name begins with...

GHSA-HWMC-4C8J-XXJ7 `sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js`

Summary sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code...

`sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js`

Summary sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial of service, type confusion, and potential remote code...

CVE-2025-62381

sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial...

CVE-2025-62381 sveltekit-superforms Prototype Pollution in `parseFormData` function of `formData.js`

sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial...

CVE-2025-62381

sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial...

CVE-2025-62381

CVE-2025-62381 affects the package sveltekit-superforms (versions up to 2.27.3). The vulnerability is in the parseFormData function of formData.js, where user-controlled values can pollute Object.prototype, enabling DoS, type confusion, and potentially remote code execution in downstream apps. Se...

CVE-2025-62381: Improperly Controlled Modification of Object Prototype Attributes

sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties into Object.prototype, leading to denial...

PT-2025-42389

Name of the Vulnerable Software and Affected Versions sveltekit-superforms versions prior to 2.27.4 Description The software, sveltekit-superforms, has an issue where the parseFormData function in formData.js is susceptible to prototype pollution. An attacker can inject properties into...

SvelteKit security vulnerabilities

SvelteKit is a set of Svelte open source web development framework. A security vulnerability exists in SvelteKit 2.27.3 and earlier versions, which stems from prototype contamination in the parseFormData function in formData.js, which could lead to a denial of service, type obfuscation, and...