Executive brief
A vulnerability in the @rvf/set-get library, used for handling web form data in Remix and React Router applications, allows attackers to modify the internal behavior of the server. By submitting specially crafted form fields, an unauthenticated user can inject malicious properties into the server's memory. This can lead to security bypasses, application crashes, or unauthorized configuration changes that persist until the server process is restarted.
Technical details
The `setPath` function in `@rvf/set-get` fails to sanitize sensitive keys such as `__proto__`, `constructor`, and `prototype` when converting flat form data into nested objects. This vulnerability is reachable via the `preprocessFormData` function in `@rvf/core`, which is commonly used in Remix and React Router applications to handle user input. An unauthenticated remote attacker can send a crafted HTTP request with field names like `__proto__[polluted]` to inject arbitrary properties into `Object.prototype`. This can result in a persistent prototype pollution state within the Node.js process, potentially leading to Denial of Service (DoS) or bypass of logic checks. The issue is fixed in versions 7.0.2 and 6.0.4 by implementing a blocklist for these reserved keys.
Affected products
- airjp73 @rvf/set-get >= 7.0.0, < 7.0.2
- airjp73 @rvf/set-get >= 6.0.0, < 6.0.4
- airjp73 @rvf/core <= 8.1.0
Timeline
- 2026-05-06: disclosed
- 2026-05-11: advisory: GitHub Advisory published
- 2026-05-27: other: NVD published