CVE-2026-46510

form-data-objectizer converts FormData to object. Prior to 1.0.1, form-data-objectizer walks bracket-notation form keys (e.g. name[sub]) into nested objects without filtering __proto__, constructor, or prototype. A single HTTP form field whose name starts with __proto__[...] causes the library to mutate Object.prototype, which is a prototype pollution primitive of the entire Node.js process. This vulnerability is fixed in 1.0.1.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/kaspernj/form-data-objectizer/commit/7c54b99408e6e9cd6533b7245bf197dadc2a2dbc
https://github.com/kaspernj/form-data-objectizer/security/advisories/GHSA-m2hg-wjq3-28wq
https://github.com/kaspernj/form-data-objectizer/security/advisories/GHSA-m2hg-wjq3-28wq

Configurations

No configuration.

History

21 Jul 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) form-data-objectizer convierte FormData a objeto. Antes de la 1.0.1, form-data-objectizer recorre las claves de formulario con notación de corchetes (p. ej., name[sub]) en objetos anidados sin filtrar __proto__, constructor o prototype. Un único campo de formulario HTTP cuyo nombre comienza con __proto__[...] hace que la biblioteca mute Object.prototype, lo cual es una primitiva de contaminación de prototipos de todo el proceso de Node.js. Esta vulnerabilidad está corregida en la 1.0.1.

02 Jun 2026, 03:16

Type	Values Removed	Values Added
References	~~() https://github.com/kaspernj/form-data-objectizer/security/advisories/GHSA-m2hg-wjq3-28wq -~~	() https://github.com/kaspernj/form-data-objectizer/security/advisories/GHSA-m2hg-wjq3-28wq -

29 May 2026, 14:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-29 14:16

Updated : 2026-07-21 12:10

NVD link : CVE-2026-46510

Mitre link : CVE-2026-46510

CVE.ORG link : CVE-2026-46510

JSON object : View

Products Affected

No product.

CWE

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2026-46510", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46510", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T01:12:21.389910Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "kaspernj", "product": "form-data-objectizer", "versions": [{"status": "affected", "version": "< 1.0.1"}]}]}], "published": "2026-05-29T14:16:31.807", "references": [{"url": "https://github.com/kaspernj/form-data-objectizer/commit/7c54b99408e6e9cd6533b7245bf197dadc2a2dbc", "source": "security-advisories@github.com"}, {"url": "https://github.com/kaspernj/form-data-objectizer/security/advisories/GHSA-m2hg-wjq3-28wq", "source": "security-advisories@github.com"}, {"url": "https://github.com/kaspernj/form-data-objectizer/security/advisories/GHSA-m2hg-wjq3-28wq", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "form-data-objectizer converts FormData to object. Prior to 1.0.1, form-data-objectizer walks bracket-notation form keys (e.g. name[sub]) into nested objects without filtering __proto__, constructor, or prototype. A single HTTP form field whose name starts with __proto__[...] causes the library to mutate Object.prototype, which is a prototype pollution primitive of the entire Node.js process. This vulnerability is fixed in 1.0.1."}, {"lang": "es", "value": "form-data-objectizer convierte FormData a objeto. Antes de la 1.0.1, form-data-objectizer recorre las claves de formulario con notaci\u00f3n de corchetes (p. ej., name[sub]) en objetos anidados sin filtrar __proto__, constructor o prototype. Un \u00fanico campo de formulario HTTP cuyo nombre comienza con __proto__[...] hace que la biblioteca mute Object.prototype, lo cual es una primitiva de contaminaci\u00f3n de prototipos de todo el proceso de Node.js. Esta vulnerabilidad est\u00e1 corregida en la 1.0.1."}], "lastModified": "2026-07-21T12:10:00.090", "sourceIdentifier": "security-advisories@github.com"}