CVE-2026-46510: form-data-objectizer Prototype Pollution Vulnerability (CVSS 8.2)

Technical summary

The vulnerability stems from unsafe bracket-notation parsing in form-data-objectizer. When processing form field names like name[sub][key], the library recursively creates nested object properties without sanitizing reserved keywords. Specifically, it fails to filter __proto__, constructor, or prototype. An attacker sends a form field named __proto__[polluted]=true, and the library assigns this to Object.prototype.polluted, poisoning the prototype chain. Because every JavaScript object inherits from Object.prototype, this mutation affects all downstream object property lookups in the process. The vector is network-accessible with no authentication required and no user interaction necessary.

Business impact

Applications using form-data-objectizer become vulnerable to silent, application-wide object property injection. An attacker may inject properties that bypass security checks, disable authentication logic, or override application constants. For multi-tenant services, this could enable cross-tenant data access or privilege escalation. The impact compounds when the application trusts form input or uses it in security-sensitive contexts. Process-wide corruption means a single HTTP request can compromise all concurrent requests and long-lived connections, making this particularly dangerous in high-throughput environments.

Affected systems

The vulnerability affects all versions of form-data-objectizer prior to 1.0.1. Applications using this library to parse FormData or URL-encoded form submissions are at risk. The affected versions are those before 1.0.1; verify your application's dependency tree to identify which projects have form-data-objectizer as a direct or transitive dependency.

Exploitability

Exploitation is trivial and requires only an HTTP form submission. No authentication, user interaction, or privileged access is needed. An unauthenticated attacker on the network can craft a malicious form and send it to any endpoint using form-data-objectizer. The attack is deterministic and reliable. The CVSS 3.1 score of 8.2 (HIGH) reflects this combination: network-accessible, low complexity, no privileges required, high integrity impact (object pollution), and low availability impact (potential DoS).

Remediation

Upgrade form-data-objectizer to version 1.0.1 or later. This version filters __proto__, constructor, and prototype from bracket-notation parsing. After patching, redeploy all affected Node.js applications. In parallel, review application code for unnecessary trust of form input in security-sensitive operations.

Patch guidance

1. Audit your package.json and lock files to identify the current version of form-data-objectizer. 2. Update the dependency to 1.0.1 or the latest version using npm update form-data-objectizer or yarn upgrade form-data-objectizer. 3. Run your test suite to confirm compatibility. 4. Redeploy to staging and production environments. 5. Verify the patch by checking package-lock.json or yarn.lock reflects 1.0.1 or later.

Detection guidance

Monitor HTTP logs for form submissions with field names containing __proto__, constructor, or prototype. Inspect web server and application logs for unusual form field names. Configure WAF rules to block or flag requests with these patterns in POST/form data. Examine runtime behavior for unexpected property pollution (check for injected properties on Object.prototype). For existing deployments, enable detailed logging of form field names before parsing.

Why prioritize this

This vulnerability rates HIGH priority because it requires minimal attacker effort, has no prerequisites, and compromises the security boundary of the entire Node.js process. Any application relying on form input for access control, session validation, or data filtering is at elevated risk. Organizations should prioritize patching within 2–4 weeks given the ease of exploitation.

Risk score, explained

CVSS 3.1 score of 8.2 reflects: (1) Network-accessible attack surface with no authentication or user interaction required; (2) low attack complexity; (3) high integrity impact through object prototype pollution affecting all objects; (4) low availability impact through potential resource exhaustion or logic errors; (5) no scope change (single process). The score aligns with the severity of a process-wide object injection primitive that is trivial to trigger.

Frequently asked questions