CVE-2026-46510: Prototype pollution in form-data-objectizer via bracket-notation form keys

Synopsis

Prototype pollution in the form-data-objectizer Node.js library, which converts FormData into JavaScript objects. The bug is reachable over the network with no authentication and no user interaction: any HTTP endpoint that feeds form data into the library will, on a single crafted field name like __proto__[polluted], mutate Object.prototype across the entire Node.js process. Successful exploitation lets an attacker tamper with object properties globally, enabling logic bypasses, privilege escalation paths, and in some apps remote code execution. The record lists no published fix version at the time of writing, so HarborGuard tracks the advisory for patch availability. Note: the description text references 1.0.1 as a fix, but no fix version is published in the structured record, so monitoring remains active.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker reaches the vulnerability by sending an HTTP form submission to any endpoint that pipes FormData into the library, so over-the-network exposure of the affected service is the entry point.

• AuthenticationNot required

  PR:N in the CVSS vector indicates no account or session is needed; any anonymous client that can POST a form payload can trigger the pollution.

• Victim interactionNot required

  UI:N applies: the attacker submits the malicious form directly and no user has to click, open, or approve anything for the prototype to be polluted.

• Attack complexityDetail

  AC:L: a single form field whose name begins with __proto__[...] is enough, with no race condition, memory layout, or environmental tuning required.

Blast Radius

• Mutates Object.prototype for the entire Node.js process, so attacker-controlled properties appear on every object the application later constructs or inspects.
• Enables integrity attacks against application logic: authorization checks, feature flags, and template rendering paths can be flipped by seeding properties the code reads via plain object lookup.
• Can degrade availability by injecting properties that cause downstream code to throw on unexpected types, matching the A:L impact in the CVSS vector.
• In applications that later spawn child processes or evaluate templates using polluted defaults, the primitive is a common stepping stone to remote code execution inside the Node.js runtime.