CVE-2026-33228 is a critical (CVSS 9.8) prototype pollution flaw in flatted, a circular JSON parser for Node.js. Its parse() function can hand callers a live reference to Array.prototype, which later writes can pollute. Upgrade flatted to 3.4.2 or later.
What's affected
All flatted versions before 3.4.2. The fixed version is 3.4.2.
flatted is widely used as a transitive dependency, often through caching, logging or test tooling, so you may run it without ever having added it to package.json.
How to check if you're exposed
List every copy of flatted in your tree:
npm ls flatted
With pnpm use pnpm why flatted, and with Yarn use yarn why flatted. Check each version listed, including copies pulled in by build tools. Then check container images and deployed bundles, which may hold an older install than your lockfile.
Paste your lockfile into the free in-browser dependency scan to see which versions you resolve, including transitive ones. Gold also lists this CVE on its directory page.
What to do now
- Upgrade flatted to 3.4.2 or later. If it is transitive, update the parent package or add an override in package.json.
- Regenerate the lockfile and run
npm ls flattedto confirm only fixed versions remain. - Rebuild and redeploy images and bundles that include the package.
- Avoid writing to properties of parsed objects without checking their keys, as a general guard against prototype pollution.
Why it matters
The weakness classes are CWE-1321 (prototype pollution) and CWE-915 (improperly controlled modification of object attributes). The parser used string values from the input as array index keys without checking that they were numeric. Because the internal buffer is a JavaScript Array, the key __proto__ returned Array.prototype through the inherited getter, and that object was placed on the output.
Any code that later writes to that property changes the prototype for the whole process. The effect depends on what the application does next, which is why reachability matters here. The record does not flag this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does a fixed parent package mean flatted is fixed?
Only if the lockfile now resolves flatted 3.4.2 or later. Run npm ls flatted after updating and check every path it prints.
Sources
Last reviewed: 19 October 2026.
