The vulnerability in @rvf/set-get before version 7.0.4 is a prototype pollution flaw that permits an unauthenticated attacker to overwrite properties of shared built-in functions via inherited Object.prototype methods. By submitting a form field named hasOwnProperty.call through the @rvf/core parsing logic, an attacker can modify the shared function property, causing the entire Node.js process to crash and resulting in a denial of service until a restart occurs. This weakness is classified as CWE‑1321 and affects the confidentiality, integrity, and availability of the affected application by disrupting its operational continuity.

Affected vendors include airjp73, with the product @rvf/set-get. All releases prior to version 7.0.4 are vulnerable. The flaw is also tied to the @rvf/core form parsing component, which processes incoming form data and applies the setPath logic that is exploitable.

The CVSS score of 8.7 categorizes the issue as high severity, indicating substantial potential impact. No EPSS score is available, so the current exploitation probability cannot be quantified; however, the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a simple HTTP form submission that leverages the setPath function; this inference is made from the description of the form parsing mechanism and the nature of the prototype pollution. An attacker does not need special privileges—unauthenticated input is sufficient—to trigger a denial of service that affects the entire process.