CVE catalog

CVE-2026-33228

Severity: Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Mar 19, 2026, 5:43:54 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.84% · Oct 25, 2026

flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key "__proto__" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	node-flatted	sid	`3.4.4~ds-1`	fixed
Debian	node-flatted	forky	`3.4.4~ds-1`	fixed
Debian	node-flatted	trixie	`3.2.7~ds-1+deb13u1`	fixed
Debian	node-flatted	bookworm	`3.2.7~ds-1+deb12u1`	vulnerable
Npm	flatted	Not reported	`3.4.2`	fixed
Cpe	node-flatted	Not reported	Not reported	vulnerable
Npm	flatted	Not reported	`3.4.2`	fixed
Cpe	flatted	Not reported	`3.4.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	node-flatted	source	sid	`3.4.2~ds-1`	not yet assigned	Not reported	[1131462]
Debian	node-flatted	source	forky	`3.4.2~ds-1`	not yet assigned	Not reported	[1131462]
Debian	node-flatted	source	trixie	`3.2.7~ds-1+deb13u1`	not yet assigned	Not reported	[1131462]
Debian	node-flatted	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1131462]
Npm	flatted	npm	Not reported	`3.4.2`	Not reported	GHSA-RF6F-7FWH-WJGH	Not reported
Npm	flatted	npm	Not reported	`3.4.2`	Not reported	Not reported	Not reported
Cpe	flatted	cpe	Not reported	`3.4.2`	Not reported	NVD-CVE-2026-33228	Not reported

[Debian bug #1131462]

Notes

[bookworm] node-flatted: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libjs-flatted]Affected
Source package: [node-flatted]
Details (2)
- 3.2.7~ds-1+deb12u1 · all · bookworm
  Affected
  nvd · node-flatted · debian · bookworm; nvd · node-flatted · debian · 12
- 3.2.7~ds-1+deb12u1 · all · bookworm
  Affected
  nvd · node-flatted · debian · bookworm; nvd · node-flatted · debian · 12
[node-flatted]Affected
Details (2)
- 3.2.7~ds-1+deb12u1 · all · bookworm
  Affected
  nvd · node-flatted · debian · bookworm; nvd · node-flatted · debian · 12
- 3.2.7~ds-1+deb12u1 · all · bookworm
  Affected
  nvd · node-flatted · debian · bookworm; nvd · node-flatted · debian · 12

[Debian 13 (Trixie)]

[libjs-flatted]Fixed
Source package: [node-flatted]
Details (2)
- 3.2.7~ds-1+deb13u1 · all · trixie
  Fixed · Fixed: 3.2.7~ds-1+deb13u1
  nvd · node-flatted · debian · 13
- 3.2.7~ds-1+deb13u1 · all · trixie
  Fixed · Fixed: 3.2.7~ds-1+deb13u1
  nvd · node-flatted · debian · 13
[node-flatted]Fixed
Details (2)
- 3.2.7~ds-1+deb13u1 · all · trixie
  Fixed · Fixed: 3.2.7~ds-1+deb13u1
  nvd · node-flatted · debian · 13
- 3.2.7~ds-1+deb13u1 · all · trixie
  Fixed · Fixed: 3.2.7~ds-1+deb13u1
  nvd · node-flatted · debian · 13

Observed: Oct 23, 2026, 10:40:20 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]