kaspernj form-data-objectizer vulnerabilities

Latest kaspernj form-data-objectizer CVEs

Newest publication first

1. CVE-2026-46510 Prototype pollution in form-data-objectizer via bracket-notation form keys

   Published 2026-05-29

   High·CVSS 8.2 EPSS 0.28%

   form-data-objectizer converts FormData to object. Prior to 1.0.1, form-data-objectizer walks bracket-notation form keys (e.g. name[sub]) into nested objects without filtering proto, constructor, or prototype. A single HTTP form field whose name starts with proto[...] causes the l...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.