CVE-2026-46510 Details

A prototype pollution vulnerability has been identified in the form-data-objectizer library, specifically in versions through 1.0.0. The issue arises because the library processes bracket-notation form keys without properly sanitizing key segments that could lead to prototype pollution, such as __proto__, constructor, or prototype. This flaw allows an HTTP form field named __proto__[polluted] to modify Object.prototype, creating a pollution effect that persists across the entire Node.js process.

Users can update to form-data-objectizer version 1.0.1, which addresses the vulnerability by rejecting form key segments that could lead to prototype pollution before processing the form data.