The form-data-objectizer library before version 1.0.1 improperly handles bracket-notation form keys by not filtering out __proto__, constructor, or prototype keys. This allows an attacker to perform prototype pollution by submitting form fields that mutate Object.prototype, affecting the entire Node.js process. Prototype pollution can lead to unexpected behavior or security issues in applications relying on this library. The vulnerability is identified as CWE-1321 and has a CVSS 3.1 score of 8.2 (high severity). The vulnerability is fixed in version 1.0.1 by properly filtering these keys.

An attacker can submit specially crafted HTTP form data that modifies the Object.prototype in the Node.js environment where form-data-objectizer is used. This can lead to integrity violations and potentially affect application logic or security controls relying on object properties. The CVSS score of 8.2 reflects a high impact on integrity with low attack complexity and no required privileges or user interaction. There are no reports of known exploits in the wild at this time.

Upgrade form-data-objectizer to version 1.0.1 or later, where the vulnerability is fixed by filtering out __proto__, constructor, and prototype keys during object construction. Since no official vendor advisory or patch link is provided, rely on upgrading to the fixed version as the primary remediation. Patch status is not explicitly confirmed beyond the version update; check the vendor repository or release notes for confirmation.