CVE-2026-44483: RVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data)

Synopsis

Prototype pollution in the @rvf/set-get package, used by @rvf/core in the RVF (Remix Validated Form) library, allows an unauthenticated remote attacker to inject arbitrary properties onto the JavaScript runtime's Object.prototype by submitting a crafted HTTP form. The vulnerability is reachable over the network with no authentication and no user interaction required, because field names from incoming form data are passed directly to the setPath function without filtering reserved keys such as __proto__, constructor, or prototype. Successful exploitation lets an attacker tamper with shared server-side state, corrupt business logic that relies on inherited object properties, or degrade service availability. No fix versions have been published yet; HarborGuard tracks this advisory for patch availability and will make a patched-image rebuild available as soon as an upstream fix ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the application's HTTP form-handling endpoints over the network; any internet-exposed or internally networked Remix or React Router app using parseFormData or createValidator is in scope.

• AuthenticationNot required

  No account or session credential is required; the vulnerability is triggered by a standard unauthenticated HTTP form submission.

• Victim interactionNot required

  No user action is needed on the server side; the attacker interacts directly with the endpoint.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race condition, memory-layout dependency, or special server configuration is required beyond the affected library version being in use.

Blast Radius

• Attacker injects arbitrary properties onto Object.prototype of the server Node.js process, affecting all objects created in that runtime for the lifetime of the process.
• Polluted prototype properties can override security checks, authentication flags, or feature guards in application code that reads inherited object properties, enabling privilege escalation or authorization bypass within the app.
• Application logic relying on property existence checks (e.g., hasOwnProperty patterns or default-value lookups) may behave incorrectly, leading to corrupted data writes or unexpected behavior in downstream business logic.
• Malformed prototype state can cause runtime exceptions in third-party libraries or framework internals sharing the same process, degrading or crashing the service.