Live › vulnerability › CVE-2026-112309
Go to dashboardThe @rvf/set-get npm package's setPath function lets an unauthenticated attacker overwrite built-in Object.prototype methods by submitting a form field named hasOwnProperty.call through @rvf/core. The overwrite persists process-wide and causes denial of service until the process restarts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
npm ls @rvf/set-get and npm ls @rvf/core to see whether either is installed and at what version7.0.4 is affected7.0.4 or later and rebuild and redeployEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form parsing to replace the shared function property, causing process-wide denial of service until restart.
This page as .md · .json · in your agent: get_signal("CVE-2026-112309")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.