@rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data)

Description

setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys __proto__, constructor, or prototype when walking a path.

Recommendation

Update the @rvf/set-get package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 6.0.0, < 6.0.4

  >= 7.0.0, < 7.0.2**

• Patched version(s): **6.0.4

  7.0.2**

References

• GHSA-c567-44rc-m5hq
• CVE-2026-44483
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging - CVE-2026-54737
• Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
• form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys - CVE-2026-46510
• LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set( - CVE-2026-40190

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@rvf/set-get