CVE-2026-112309
Description
A flaw was found in set-get. An unauthenticated remote attacker can exploit this prototype pollution vulnerability to cause a Denial of Service (DoS) by submitting specially crafted form input. By manipulating object property paths during form data processing, an attacker can overwrite shared internal functions, disrupting application availability until the service is restarted.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker can trigger an application-wide denial of service without requiring privileges or user interaction. When applications process untrusted form input using affected components, property path manipulation corrupts inherited object methods across the runtime environment. This disruption compromises core built-in functions, resulting in continuous failure of dependent application services until the underlying process is restarted.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
An attacker could modify sensitive data or program variables.
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Other,Integrity
Technical Impact: Varies by Context; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
