PT-2026-41696 · Git+2 · Form-Data-Objectizer

0Xbassia · Published 2026-05-18 · Updated 2026-06-02 · CVE-2026-46510

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions form-data-objectizer versions prior to 1.0.1

Description The software fails to filter proto, constructor, or prototype when converting FormData to objects using bracket-notation form keys. An attacker can submit a single HTTP form field with a name starting with proto [...] to mutate Object.prototype, leading to prototype pollution across the entire Node.js process. This occurs within the treatInitial() and treatSecond() functions in index.cjs. This issue can be exploited to bypass security checks, inject configuration values, disrupt template rendering, or cause a denial of service by crashing the worker process.

Recommendations Update to version 1.0.1.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-46510

GHSA-M2HG-WJQ3-28WQ

Affected Products

Form-Data-Objectizer

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46510.json · Exploit
• 🔥 https://github.com/kaspernj/form-data-objectizer/security/advisories/GHSA-m2hg-wjq3-28wq · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-46510 · Security Note
• https://osv.dev/vulnerability/GHSA-m2hg-wjq3-28wq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-46510 · Vendor Advisory
• https://t.me/CVEtracker/55265 · Telegram Post
• https://github.com/kaspernj/form-data-objectizer · Note
• https://t.me/cveNotify/165578 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1tgqoye/resumen_diario_de_vulnerabilidades_18052026 · Reddit Post
• https://github.com/kaspernj/form-data-objectizer/commit/7c54b99408e6e9cd6533b7245bf197dadc2a2dbc · Note