The flat-to-nested-js library converts flat hierarchical data into nested structures. In versions before 1.1.2, the convert() function uses attacker-influenced id and parent record fields as keys in internal objects (temp and pendingChildOf) without proper validation. If these fields are set to '__proto__', the code modifies Object.prototype via temp[parent], enabling prototype pollution. This can corrupt application logic or cause denial of service, and may enable further exploitation if a downstream prototype-pollution gadget exists. The vulnerability also involves unsafe inherited-key values such as 'constructor' and 'prototype'. The flaw is resolved in version 1.1.2.

Exploitation allows an attacker to perform prototype pollution by injecting properties into Object.prototype via specially crafted flat records. This can corrupt application logic or cause denial of service. While no direct confidentiality or availability impact is indicated, the integrity of application state can be compromised. The vulnerability has a CVSS 3.1 score of 7.5 (high severity), reflecting its potential to cause significant integrity issues without requiring privileges or user interaction.

Upgrade to flat-to-nested-js version 1.1.2 or later, where this prototype pollution vulnerability is fixed. No other mitigation is required as the fix addresses the root cause by properly handling attacker-controlled keys.