CVE-2026-55091

flat-to-nested, an npm library that converts flat record lists into nested hierarchies, contains a prototype pollution flaw (CWE-915/CWE-1321) in FlatToNested.prototype.convert in index.js. The function uses attacker-supplied id and parent record fields directly as keys on plain JavaScript objects (temp and pendingChildOf), so a record whose id or parent is __proto__ causes temp[parent] to resolve to Object.prototype, and initPush() writes attacker-controlled data to the inherited children property (with constructor and prototype being similarly unsafe key values). Any application that passes attacker-influenced flat records to convert() can expose unrelated objects to polluted inherited state, causing application-logic corruption, denial of service, or greater impact if a downstream prototype-pollution gadget is present. The flaw affects all versions before 1.1.2 and is fixed in 1.1.2; it is rated High at CVSS 3.1 7.5 with high integrity impact. No public PoC or in-the-wild exploitation is known, and it is not listed in the CISA KEV catalog.

What to do: Upgrade flat-to-nested to version 1.1.2 or later. If immediate upgrade is not possible, validate that id and parent values passed to convert() are never __proto__, constructor, or prototype before invoking the library. Audit your code paths to confirm whether attacker-reachable input flows into convert(), and check your dependency tree for downstream prototype-pollution gadgets that could amplify this into code execution or broader integrity compromise.