CVE-2026-33228 - Vulnerability Analysis

Overview

flatted < 3.4.2 contains a prototype pollution caused by improper validation of array index keys in parse() function, letting attackers leak and modify Array.prototype, exploit requires crafted JSON input.

Severity & Score

Impact

Attackers can pollute the global prototype, leading to potential application logic corruption or security bypass.

Mitigation

Update to version 3.4.2 or later.

References

• https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802
• https://github.com/WebReflection/flatted/releases/tag/v3.4.2
• https://github.com/WebReflection/flatted/security/advisories/GHSA-rf6f-7fwh-wjgh

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 23, 2026

🔴 CVE-2026-33228 - Critical (9.8) flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the internal inpu... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33228/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner