The vulnerability is a prototype pollution flaw in the form-data-objectizer library, where unfiltered bracket-notation keys beginning with __proto__ can modify Object.prototype. This compromise of fundamental JavaScript prototypes could allow an attacker to alter behavior across the entire Node.js process, potentially leading to arbitrary code execution or privilege escalation. The weakness corresponds to CWE‑1321, indicating uncontrolled modification of an object's prototype.

The affected product is the Kaspernj Form Data Objectizer library, versions prior to 1.0.1. Any Node.js application that depends on this library and processes form-data with bracket notation is vulnerable.

The CVSS score of 8.2 marks this as a high‑severity flaw. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified, and it is not listed in CISA KEV. The likely attack vector is inferred to be an HTTP form submission to an application that uses form-data-objectizer, as the flaw is triggered by form keys supplied in a request. Without additional mitigation, an attacker who succeeds in sending a malicious form could alter Object.prototype and thereby affect the entire Node.js runtime.