
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
parse-nested-form-data
Advanced tools
A tiny node module for parsing FormData by name into objects and arrays
A tiny node module for parsing FormData by name into objects and arrays
A parse functions that uses the name prop to tells the parser how to create an object out of the values. You can tell the parser to do not parse empty values.
This module is distributed via npm which is bundled with node and
should be installed as one of your project's dependencies:
npm install parse-nested-form-data
The name prop is used to tell the parser how to create an object out of the values. The name prop is a string that can contain the following characters:
.: to create a nested object[]: to create an array (pushes value)[$order]: to create an array (sets value at index and squashes array)&: to transform the value to a boolean-: to transform the value to null+: to transform the value to a numberIf the name prop starts with a & the value will be transformed to a boolean.
True if the value has the following values:
true1onconst formData = new FormData()
formData.append('&isTrue', 'true')
formData.append('&isFalse', 'false')
formData.append('&isTrue1', '1')
formData.append('&isFalse1', '0')
formData.append('&isTrue2', 'on')
formData.append('&isFalse2', 'off')
parseFormData(formData)
// {
// isTrue: true,
// isFalse: false,
// isTrue1: true,
// isFalse1: false,
// isTrue2: true,
// isFalse2: false,
// }
If the name prop starts with a + the value will be transformed to a number.
const formData = new FormData()
formData.append('+number', '1')
formData.append('+number2', '1.1')
formData.append('+number3', 'a')
parseFormData(formData)
// {
// number: 1,
// number2: 1.1,
// number3: NaN,
// }
If the name prop starts with a - the value will be transformed to null.
const formData = new FormData()
formData.append('-null', 'null')
formData.append('-ignored', 'ignored')
parseFormData(formData)
// {
// null: null,
// ignored: null,
// }
If a path of the name prop ends with [] the value will be pushed to an array.
If the path of the name prop ends with [$order] the value will be set at the
index of the order. Cannot be mixed with [].
const formData = new FormData()
formData.append('array[0]', '1')
formData.append('array[1]', '2')
formData.append('array[2]', '3')
formData.append('array[3]', '4')
parseFormData(formData)
// {
// array: ['1', '2', '3', '4'],
// }
const formData = new FormData()
formData.append('array[]', '1')
formData.append('array[]', '2')
formData.append('array[]', '3')
parseFormData(formData)
// {
// array: ['1', '2', '3'],
// }
Also works with nested objects:
const formData = new FormData()
formData.append('array[0].a', '1')
formData.append('array[1].a', '2')
formData.append('array[2].a', '3')
parseFormData(formData)
// {
// array: [{a: '1'}, {a: '2'}, {a: '3'}],
// }
Also works with nested arrays:
const formData = new FormData()
formData.append('array[0][]', '1')
formData.append('array[0][]', '2')
formData.append('array[1][]', '3')
formData.append('array[1][]', '4')
parseFormData(formData)
// {
// array: [['1', '2'], ['3', '4']],
// }
If the name prop contains a . the value will be nested in an object.
const formData = new FormData()
formData.append('object.a', '1')
formData.append('object.b', '2')
parseFormData(formData)
// {
// object: {
// a: '1',
// b: '2',
// },
// }
const formData = new FormData()
formData.append('+a', '1')
formData.append('&b', 'true')
formData.append('-c', 'null')
formData.append('d', 'foo')
parseFormData(formData, defaultTransform)
// => {a: 1, b: true, c: null, d: 'foo'}
Complex examples:
const formData = new FormData()
formData.append('a[].b.c', '1')
formData.append('a[].b.d', '2')
formData.append('a[]', '3')
formData.append('b[0]', '4')
formData.append('+b[100]', '5')
parseFormData(formData)
// {
// a: [
// {
// b: {
// c: '1',
// d: '2',
// },
// },
// '3',
// ],
// b: ['4', 5],
// }
The second argument is an option object with following properties:
[boolean]Default: false
If true empty strings will be removed from the result.
const formData = new FormData()
formData.append('foo[1].foo', '')
formData.append('foo[1].bar', 'test2')
formData.append('foo[0].foo', 'test3')
formData.append('foo[0].baz', '4')
parseFormData(formData, {removeEmptyString: true})
// {foo: [{foo: 'test3', baz: '4'}, {bar: 'test2'}]}
(entry: [path: string, value: string | File], defaultTransform: DefaultTransform) => [string, string | JsonLeafValue]const formData = new FormData()
formData.append('a', 'a')
formData.append('b', 'b')
parseFormData(formData, {
transformEntry: ([path, value], defaultTransform) => {
return {
path,
value:
typeof value === 'string'
? value.toUpperCase()
: defaultTransform(value),
}
},
})
// => {a: 'A', b: 'B'}
Looking to contribute? Look for the Good First Issue label.
Please file an issue for bugs, missing documentation, or unexpected behavior.
Please file an issue to suggest new features. Vote on feature requests by adding a 👍. This helps maintainers prioritize what to work on.
Thanks goes to these people (emoji key):
This project follows the all-contributors specification. Contributions of any kind welcome!
MIT
Special thanks to Kent C. Dodds and his match-sorter package where most of the setup is from.
FAQs
A tiny node module for parsing FormData by name into objects and arrays
The npm package parse-nested-form-data receives a total of 1,177 weekly downloads. As such, parse-nested-form-data popularity was classified as popular.
We found that parse-nested-form-data demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.