High, CVSS 8.2npmAmendedPublished
@rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data)
CVE-2026-44483 · GHSA-c567-44rc-m5hq
- Affected
- npm @rvf/set-get >= 7.0.0, < 7.0.2; >= 6.0.0, < 6.0.4
- Fixed in
- 7.0.26.0.4· Vendor fix available
- Issue
- setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys proto, constructor, or prototype when walking a path. Because field names in submitted form data are passed directly to setPath via preprocessFormData (and through parseFormData / validate), an attacker who can submit a form to a Remix / React Router app using the library can set arbitrary properties on Object.prototype of the running server process. This is a default-reachable prototype pollution primitive: no special configuration is required. Any endpoint that accepts a form via parseFormData or runs a validator created with createValidator is affected. Affected versions - @rvf/set-get < 7.0.2 (7.x line) - @rvf/set-get < 6.0.4 (6.x line) Reached through @rvf/core versions that depend on a vulnerable @rvf/set-get (current 8.1.0 resolves to 7.0.1 without the override). Patched - @rvf/set-get 7.0.2 - @rvf/set-get 6.0.4 The fix adds a REJECTKEYS blocklist…
Recommended action: Upgrade to 7.0.2 or 6.0.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.