The parse-nested-form-data module versions before 1.0.1 improperly handle FormData field names that include '__proto__' by traversing and assigning properties on Object.prototype. This prototype pollution vulnerability (CWE-1321) allows an attacker to inject properties into the global prototype chain, affecting all plain objects in the Node.js process. The vulnerability has a CVSS 3.1 score of 8.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts integrity and availability. The issue is fixed in version 1.0.1.

Exploitation of this vulnerability allows an attacker to modify the prototype of all plain objects in the running Node.js process, potentially leading to integrity violations and partial denial of service conditions. There is no direct confidentiality impact. No known exploits are reported in the wild. The vulnerability affects all deployments using parse-nested-form-data versions prior to 1.0.1.

Upgrade parse-nested-form-data to version 1.0.1 or later, where the vulnerability is patched. Since no official remediation level or vendor advisory is provided, this upgrade is the recommended action to prevent prototype pollution. Patch status is confirmed by the description stating the issue is fixed in version 1.0.1.