CVE-2026-33228 (Critical) detected in flatted-3.4.1.tgz

[mend-bolt-for-github]

CVE-2026-33228 - Critical Severity Vulnerability

Vulnerable Library - flatted-3.4.1.tgz

A super light and fast circular JSON parser.

Library home page: https://registry.npmjs.org/flatted/-/flatted-3.4.1.tgz

Path to dependency file: /ui/package.json

Path to vulnerable library: /ui/node_modules/.pnpm/flatted@3.4.1/node_modules/flatted/package.json

Dependency Hierarchy:

• @postgres.ai/ce-4.0.3.tgz (Root Library)
  • eslint-plugin-cypress-2.15.2.tgz
    • eslint-8.57.1.tgz
      • file-entry-cache-6.0.1.tgz
        • flat-cache-3.2.0.tgz
          • ❌ flatted-3.4.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal input buffer is a JavaScript Array, accessing it with the key "proto" returns Array.prototype via the inherited getter. This object is then treated as a legitimate parsed value and assigned as a property of the output object, effectively leaking a live reference to Array.prototype to the consumer. Any code that subsequently writes to that property will pollute the global prototype. This issue has been patched in version 3.4.2.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-03-20

URL: CVE-2026-33228

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rf6f-7fwh-wjgh

Release Date: 2026-03-19

Fix Resolution: flatted - 3.4.2

---

Step up your Open Source Security Game with Mend here