Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

form-data-objectizer

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2npmAmendedPublished

    form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys

    CVE-2026-46510 · GHSA-m2hg-wjq3-28wq

    Affected
    • npm form-data-objectizer <= 1.0.0
    Fixed in
    1.0.1· Vendor fix available
    Issue
    form-data-objectizer walks bracket-notation form keys (e.g. name[sub]) into nested objects without filtering proto, constructor, or prototype. A single HTTP form field whose name starts with proto[...] causes the library to mutate Object.prototype, which is a prototype pollution primitive of the entire Node.js process. The bug is in treatInitial and treatSecond inside index.cjs: With the form key proto[polluted] and value yes: 1. treatInitial matches inputName = "proto", rest = "[polluted]". 2. "proto" in result is true (inherited), so newResult = result["proto"], which is Object.prototype. 3. treatSecond recurses with key = "polluted", newRest = "", and assigns Object.prototype.polluted = "yes". Affected versions - form-data-objectizer <= 1.0.0 (currently the only published version) Patched Not yet. Suggested fix: reject any segment equal to proto, constructor, or prototype before walking into result[inputName] / result[key]. Either throw or skip the entry. Minimum patch in…

    Recommended action: Upgrade to 1.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →