CVE-2026-44483
CVE-2026-44483 · RVF: Prototype pollution in @rvf/set-get reachable via @rvf/core preprocessFormData (HTTP form data)
This page contains facts from public vulnerability sources. Check the original advisory before updating.
RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys __proto__, constructor, or prototype when walking a path. Because field names in submitted form data are passed directly to setPath via preprocessFormData (and through parseFormData / validate), an attacker who can submit a form to a Remix / React Router app using the library can set arbitrary properties on Object.prototype of the running server process. This is a default-reachable prototype pollution primitive: no special configuration is required. Any endpoint that accepts a form via parseFormData or runs a validator created with createValidator is affected. This vulnerability is fixed in 6.0.4 and 7.0.2.
CVSS 8.2 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
rvf
- Versions
- >= 7.0.0, < 7.0.2: Affected
- >= 6.0.0, < 6.0.4: Affected
No fix published
set-get
- Versions
- >= 7.0.0, < 7.0.2: Affected
- >= 6.0.0, < 6.0.4: Affected
No fix published
@rvf/set-get npm
- Affected ranges
- SEMVER: ≥ 7.0.0, < 7.0.2
Update to 7.0.2
@rvf/set-get npm
- Affected ranges
- SEMVER: ≥ 6.0.0, < 6.0.4
Update to 6.0.4