The kaspernj form-data-objectizer library versions before 1.0.1 improperly handle bracket-notation form keys by not filtering out __proto__, constructor, or prototype keys. This flaw enables an attacker to perform prototype pollution by submitting form fields with names starting with __proto__[...], which mutates Object.prototype. Such mutation can lead to widespread impact on the Node.js process using this library. The issue is classified under CWE-1321 and has been assigned CVE-2026-46510. The vulnerability is resolved in version 1.0.1 of the library.

Exploitation of this vulnerability allows an attacker to modify the Object.prototype in the Node.js environment where the vulnerable form-data-objectizer library is used. This can lead to unexpected behavior or security issues in applications relying on object prototypes, potentially affecting integrity and availability. The CVSS score of 8.2 reflects a high severity due to the network attack vector, no required privileges or user interaction, and a high impact on integrity with some impact on availability. Confidentiality is not impacted.

Upgrade the kaspernj form-data-objectizer library to version 1.0.1 or later, where this prototype pollution vulnerability is fixed. Since no official patch link or advisory is provided, verify the upgrade through the vendor's official repository or package manager. Avoid using vulnerable versions (<1.0.1) in production environments. Patch status is not explicitly confirmed beyond the version fix, so check the vendor advisory for the latest remediation guidance.