CVE-2026-112309 Details
Description
@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form parsing to replace the shared function property, causing process-wide denial of service until restart.
A prototype pollution vulnerability has been identified in the @rvf/set-get package, affecting versions prior to 7.0.4. The vulnerability resides in the setPath function, where unauthenticated attackers can exploit inherited Object.prototype methods to overwrite properties of shared built-in functions. This is achieved by submitting a form field named 'hasOwnProperty.call' through the @rvf/core form parsing, which replaces the shared function property. The exploitation of this vulnerability leads to a process-wide denial-of-service condition that persists until the process is restarted.
Users are advised to update to version 7.0.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| @rvf/set-get | >= 0, < 7.0.4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 22, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |