Summary form-data-objectizer walks bracket-notation form keys (e.g. name[sub]) into nested objects without filtering __proto__, constructor, or prototype. A single HTTP form field whose name starts with __proto__[...] c…
| CVE ID | CVE-2026-46510 |
| Vendor | npm |
| Affected Product | form-data-objectizer |
| Vulnerability Type | Vulnerability |
| CVSS Score | 8.2 (HIGH) |
| Actively Exploited | ❌ No known exploitation |
| Patch Status | See Vendor Advisory → |
| Reported By | CYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories) |
#
form-data-objectizer walks bracket-notation form keys (e.g. name[sub]) into nested objects without filtering __proto__, constructor, or prototype. A single HTTP form field whose name starts with __proto__[...] causes the library to mutate Object.prototype, which is a prototype pollution primitive of the entire Node.js process. The bug is in treatInitial and treatSecond inside index.cjs: ``jsif (inputName in result) { // 'in' walks the prototype chain, so '__proto__' matches newResult = result[inputName] // newResult === Object.prototype } // ... result[key] = value // sets the property on Object.prototype ` With the form key __proto__[polluted] and value yes: 1. treatInitial matches inputName = "__proto__", rest = "[polluted]". 2. "__proto__" i
Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.