form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys
Date: 2026-05
Affected: npm/form-data-objectizer
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-46510
CWE: CWE-1321
CVSS: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L)

## Summary `form-data-objectizer` walks bracket-notation form keys (e.g. `name[sub]`) into nested objects without filtering `__proto__`, `constructor`, or `prototype`. A single HTTP form field whose name starts with `__proto__[...]` causes the library to mutate `Object.prototype`, which is a prototype pollution primitive of the entire Node.js process. The bug is in `treatInitial` and `treatSecond` inside `index.cjs`: ```js if (inputName in result) { // 'in' walks the prototype chain, so '__proto__' matches newResult = result[inputName] // newResult === Object.prototype } // ... result[key] = value // sets the property on Object.prototype ``` With the form key `__proto__[polluted]` and value `yes`: 1. `treatInitial` matches `inputName = "__proto__"`, `rest = "[polluted]"`. 2. `"__proto__" in result` is true (inherited), so `newResult = result["__proto__"]`, which is `Object.prototype`. 3. `treatSecond` recurses with `key = "polluted"`, `newRest = ""`, and assigns `Object.prototype.polluted = "yes"`. ## Affected versions - `form-data-objectizer` `<= 1.0.0` (currently the only published version) ## Patched Not yet. Suggested fix: reject any segment equal to `__proto__`, `constructor`, or `prototype` before walking into `result[inputName]` / `result[key]`. Either throw or skip the entry. Minimum patch in `treatInitial` and `treatSecond`: ```js const REJECT = new Set(['__proto__', 'constructor', 'prototype']); if (REJECT.has(inputName)


Mitigations:

Architectural layers (MAESTRO):