High severity8.2GHSA Advisory· Published May 29, 2026· Updated Jun 2, 2026
CVE-2026-46510
CVE-2026-46510
Description
form-data-objectizer converts FormData to object. Prior to 1.0.1, form-data-objectizer walks bracket-notation form keys (e.g. name[sub]) into nested objects without filtering __proto__, constructor, or prototype. A single HTTP form field whose name starts with __proto__[...] causes the library to mutate Object.prototype, which is a prototype pollution primitive of the entire Node.js process. This vulnerability is fixed in 1.0.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
form-data-objectizernpm | < 1.0.1 | 1.0.1 |
Affected products
1- Range: <= 1.0.0
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.