Skip to content
Threat Feed
Subscribe

Vendor

Rvf

2 briefs RSS
low advisory

Prototype Pollution Vulnerability in @rvf/set-get

The @rvf/set-get library prior to version 7.0.4 is vulnerable to prototype pollution, allowing unauthenticated attackers to trigger a process-wide denial of service via malicious form field submissions.

@rvf/set-get
1t 1c
high advisory

@rvf/set-get Prototype Pollution via Form Data Processing (CVE-2026-44483)

The `@rvf/set-get` library, used by `@rvf/core`, is vulnerable to prototype pollution via form data processing; the `setPath` function does not block the keys `__proto__`, `constructor`, or `prototype` when walking a path, allowing attackers to set arbitrary properties on `Object.prototype` of the running server process via HTTP form submissions (CVE-2026-44483).

@rvf/set-get +1 prototype-pollution web-application javascript
2r 1t