@rvf/set-get: Prototype pollution in setPath allows denial of service
Summary
The npm package @rvf/set-get before 7.0.4 contains a prototype pollution flaw in its setPath function, which RVF uses to turn submitted form fields into nested objects. An unauthenticated attacker can submit a form field named hasOwnProperty.call to overwrite a shared built-in function, which can crash the Node.js process until it is restarted. The impact is availability only, and the attack requires no login or special configuration beyond an RVF-based form path.
Affected
- @rvf/set-get versions before 7.0.4 (CVE record: 0 to < 7.0.4)
- Packages that depend on @rvf/set-get, such as @rvf/core, if they use the vulnerable version
- Earlier related issue CVE-2026-44483: versions 7.0.2 and 7.0.3 also remain affected by this CVE
- Whether 6.x versions are affected is unclear, as the range includes them; treat them as affected
Fixed in
- Upgrade @rvf/set-get to version 7.0.4 or later
Workaround
- No workaround is documented by the vendor; upgrading is the fix.
- If an upgrade is delayed, consider rejecting form field names containing __proto__, constructor, prototype or hasOwnProperty at a reverse proxy or WAF. This is not a vendor recommendation and must be tested first.
Exploitation
- No known exploitation in the wild in the sources reviewed.
- No public proof of concept found in the sources reviewed.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Scan repositories and build artefacts for @rvf/set-get, @rvf/core and related RVF packages.
- Upgrade to @rvf/set-get 7.0.4 or later and redeploy applications, including those on 7.0.2 and 7.0.3.
- Restart affected services after patching and monitor for unexpected process crashes or restarts.
- Prioritise public-facing Remix, React Router or other RVF-based web applications.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OSV: CVE-2026-112309 osv.dev
- VulnCheck advisory: @rvf/set-get prototype pollution via setPath www.vulncheck.com
- Fix commit 4a5e118 in airjp73/rvf github.com
- setPath.ts at 61172ff github.com
- flatten.ts at 61172ff github.com
- OSV: GHSA-c567-44rc-m5hq (related CVE-2026-44483) osv.dev
- VulDB: CVE-2026-112309 vuldb.com
- OpenCVE: CVE-2026-112309 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:02.
Original description (NVD)
@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form parsing to replace the shared function property, causing process-wide denial of service until restart.
NVD references (4)
- https://github.com/airjp73/rvf/blob/61172ff01bf1250893108e5c80f35b5ac0388ecb/packages/core/src/native-form-da…
- https://github.com/airjp73/rvf/blob/61172ff01bf1250893108e5c80f35b5ac0388ecb/packages/set-get/src/setPath.ts
- https://github.com/airjp73/rvf/commit/4a5e118667549ac41f065b4cfa80b995841c3811
- https://www.vulncheck.com/advisories/rvf-set-get-before-7.0.4-prototype-pollution-via-setpath-inherited-metho…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.