« Volver al listado

CVE-2026-46510

Estado: AplazadaAlta (8.2)—

form-data-objectizer converts FormData to object. Prior to 1.0.1, form-data-objectizer walks bracket-notation form keys (e.g. name[sub]) into nested objects without filtering __proto__, constructor, or prototype. A single HTTP form field whose name starts with __proto__[...] causes the library to mutate Object.prototype, which is a prototype pollution primitive of the entire Node.js process. This vulnerability is fixed in 1.0.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de prototype pollution (CWE-1321) en librería expuesta en red sin autenticación (AV:N/PR:N/UI:N). Permite manipular Object.prototype causando corrupción de datos y potencial ejecución de código en el proceso Node.js.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software InstallationLimit Access to Resource Over Network

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Form-data-objectizer — Form-data-objectizerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-46510",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-46510",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-02T01:12:21.389910Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "kaspernj",
          "product": "form-data-objectizer",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-29T14:16:31.807",
  "references": [
    {
      "url": "https://github.com/kaspernj/form-data-objectizer/commit/7c54b99408e6e9cd6533b7245bf197dadc2a2dbc",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/kaspernj/form-data-objectizer/security/advisories/GHSA-m2hg-wjq3-28wq",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/kaspernj/form-data-objectizer/security/advisories/GHSA-m2hg-wjq3-28wq",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "form-data-objectizer converts FormData to object. Prior to 1.0.1, form-data-objectizer walks bracket-notation form keys (e.g. name[sub]) into nested objects without filtering __proto__, constructor, or prototype. A single HTTP form field whose name starts with __proto__[...] causes the library to mutate Object.prototype, which is a prototype pollution primitive of the entire Node.js process. This vulnerability is fixed in 1.0.1."
    },
    {
      "lang": "es",
      "value": "form-data-objectizer convierte FormData a objeto. Antes de la 1.0.1, form-data-objectizer recorre las claves de formulario con notación de corchetes (p. ej., name[sub]) en objetos anidados sin filtrar __proto__, constructor o prototype. Un único campo de formulario HTTP cuyo nombre comienza con __proto__[...] hace que la biblioteca mute Object.prototype, lo cual es una primitiva de contaminación de prototipos de todo el proceso de Node.js. Esta vulnerabilidad está corregida en la 1.0.1."
    }
  ],
  "lastModified": "2026-07-21T12:10:00.090",
  "sourceIdentifier": "security-advisories@github.com"
}