CVE-2026-46510

form-data-objectizer converts FormData to object. Prior to 1.0.1, form-data-objectizer walks bracket-notation form keys (e.g. name[sub]) into nested objects without filtering __proto__, constructor, or prototype. A single HTTP form field whose name starts with __proto__[...] causes the library to mutate Object.prototype, which is a prototype pollution primitive of the entire Node.js process. This vulnerability is fixed in 1.0.1.

• CWE-1321

• https://github.com/kaspernj/form-data-objectizer/commit/7c54b99408e6e9cd6533b7245bf197dadc2a2dbc
• https://github.com/kaspernj/form-data-objectizer/security/advisories/GHSA-m2hg-wjq3-28wq
• https://github.com/kaspernj/form-data-objectizer/security/advisories/GHSA-m2hg-wjq3-28wq

Published

May 29, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46493HAX CMS helps manage microsite universe with PHP or NodeJs b…7.5
• CVE-2026-46496HAX CMS helps manage microsite universe with PHP or NodeJs b…9.3
• CVE-2026-46497Crawlee is a web scraping and browser automation library. Fr…2.3
• CVE-2026-4650The FundPress – WordPress Donation Plugin for WordPress is v…5.3
• CVE-2026-46508Turborepo is a high-performance build system for JavaScript …7.8
• CVE-2026-46509deepobj provides get, set, delete deep objects in javascript…8.2
• CVE-2026-46511HAX CMS helps manage microsite universe with PHP or NodeJs b…8.7
• CVE-2026-46512Frogman provides headless PBX control through MCP and HTTP A…9.9
• CVE-2026-46513Frogman provides headless PBX control through MCP and HTTP A…7.4
• CVE-2026-46514Frogman provides headless PBX control through MCP and HTTP A…6.5
• CVE-2026-46515Frogman provides headless PBX control through MCP and HTTP A…9.3
• CVE-2026-46516Frogman provides headless FreePBX control. Prior to version …4.8