Executive brief
form-data-objectizer is a library used to convert web form data into structured JavaScript objects. A security flaw allows an attacker to submit a specially crafted form field that modifies the fundamental behavior of the entire application server. This can lead to unauthorized access, data corruption, or service instability by injecting malicious properties into every object handled by the application.
Technical details
A prototype pollution vulnerability exists in form-data-objectizer prior to version 1.0.1. The library's recursive walking logic in the 'treatInitial' and 'treatSecond' functions fails to sanitize sensitive keys such as '__proto__', 'constructor', and 'prototype' when parsing bracket-notation form keys (e.g., 'name[sub]'). By submitting a malicious HTTP form field, an unauthenticated remote attacker can mutate 'Object.prototype'. This primitive can be leveraged to bypass security checks, modify application configuration, or cause a denial of service. The issue is fixed in version 1.0.1 by implementing a blocklist for these sensitive keys.
Affected products
- kaspernj form-data-objectizer < 1.0.1
Timeline
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: CVE-2026-46510 published to NVD
- 2026-05-29: patched: Fix committed in version 1.0.1