EUVD-2026-323654

fkie_cve-2026-46510

form-data-objectizer converts FormData to object. Prior to 1.0.1, form-data-objectizer walks bracket-notation form keys (e.g. name[sub]) into nested objects without filtering __proto__, constructor, or prototype. A single HTTP form field whose name starts with __proto__[...] causes the library to mutate Object.prototype, which is a prototype pollution primitive of the entire Node.js process. This vulnerability is fixed in 1.0.1.

GHSA-m2hg-wjq3-28wq — form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys

Affected: npm: form-data-objectizer

## Summary

`form-data-objectizer` walks bracket-notation form keys (e.g. `name[sub]`) into nested objects without filtering `__proto__`, `constructor`, or `prototype`. A single HTTP form field whose name starts with `__proto__[...]` causes the library to mutate `Object.prototype`, which is a prototype pollution primitive of the entire Node.js process.

The bug is in `treatInitial` and `treatSecond` inside `index.cjs`:

```js if (inputName in result) { // 'in' walks the prototype chain, so '__proto__' matches newResult = result[inputName] // newResult === Object.prototype } // ... result[key] = value // sets the property on Object.prototype ```

With the form key `__proto__[polluted]` and value `yes`:

1. `treatInitial` matches `inputName = "__proto__"`, `rest = "[polluted]"`. 2. `"__proto__" in result` is true (inherited), so `newResult = result["__proto__"]`, which is `Object.prototype`. 3. `treatSecond` recurses with `key = "polluted"`, `newRest = ""`, and assigns `Object.prototype.polluted = "yes"`.

## Affected versions

- `form-data-objectizer` `<= 1.0.0` (currently the only published version)

## Patched

Not yet. Suggested fix: reject any segment equal to `__proto__`, `constructor`, or `prototype` before walking into `result[inputName]` / `result[key]`. Either throw or skip the entry.

Minimum patch in `treatInitial` and `treatSecond`:

```js const REJECT = new Set(['__proto__', 'constructor', 'prototype']); if (REJECT.has(inputName)…

Most recent entries from all

EUVD-2026-323654

fkie_cve-2026-46510

GHSA-m2hg-wjq3-28wq — form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys