Rvf Set Get
Monthly
Prototype pollution in @rvf/set-get before 7.0.4 lets remote attackers crash a Node.js process by submitting a form field named 'hasOwnProperty.call' (or a similar dotted path into an inherited Object.prototype method) through @rvf/core form parsing. Because setPath resolves inherited properties with a plain `obj[part] === undefined` check, it walks into Object.prototype and overwrites the shared built-in function, denying service process-wide until restart. The CVSS 4.0 vector scores 8.7 with PR:N and UI:N, meaning no authentication or user interaction is required; no public exploit code was identified at time of analysis, and the practical scope is limited to applications that route untrusted form input through the vulnerable @rvf parsing stack, with impact confined to a recoverable denial of service rather than code execution or data exposure.
Prototype pollution in @rvf/set-get before 7.0.4 lets remote attackers crash a Node.js process by submitting a form field named 'hasOwnProperty.call' (or a similar dotted path into an inherited Object.prototype method) through @rvf/core form parsing. Because setPath resolves inherited properties with a plain `obj[part] === undefined` check, it walks into Object.prototype and overwrites the shared built-in function, denying service process-wide until restart. The CVSS 4.0 vector scores 8.7 with PR:N and UI:N, meaning no authentication or user interaction is required; no public exploit code was identified at time of analysis, and the practical scope is limited to applications that route untrusted form input through the vulnerable @rvf parsing stack, with impact confined to a recoverable denial of service rather than code execution or data exposure.