Prototype Pollution Vulnerability in RVF Library Used by React
CVE-2026-44483
What is CVE-2026-44483?
The RVF (Remix Validated Form) library, essential for managing form validation within React applications, is susceptible to a prototype pollution vulnerability. This issue arises from the setPath function in @rvf/set-get, which fails to restrict keys such as proto, constructor, and prototype when navigating through incoming form data. As a result, an attacker can exploit this flaw by submitting crafted form inputs to a server using the library, allowing them to manipulate Object.prototype properties on the server process. This security risk highlights the importance of ensuring form data is appropriately sanitized, particularly when using endpoints that utilize parseFormData or createValidator methods. The vulnerability is addressed in versions 6.0.4 and 7.0.2.
Affected Version(s)
rvf >= 7.0.0, < 7.0.2 < 7.0.0, 7.0.2
rvf >= 6.0.0, < 6.0.4 < 6.0.0, 6.0.4
set-get >= 7.0.0, < 7.0.2 < 7.0.0, 7.0.2