CVE-2026-46510: form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys

form-data-objectizer walks bracket-notation form keys (e.g. name[sub]) into nested objects without filtering __proto__, constructor, or prototype. A single HTTP form field whose name starts with __proto__[...] causes the library to mutate Object.prototype, which is a prototype pollution primitive of the entire Node.js process.

The bug is in treatInitial and treatSecond inside index.cjs:

if (inputName in result) {           // 'in' walks the prototype chain, so '__proto__' matches
newResult = result[inputName]      // newResult === Object.prototype
}
// ...
result[key] = value                  // sets the property on Object.prototype

With the form key __proto__[polluted] and value yes:

1. treatInitial matches inputName = "__proto__", rest = "[polluted]".
2. "__proto__" in result is true (inherited), so newResult = result["__proto__"], which is Object.prototype.
3. treatSecond recurses with key = "polluted", newRest = "", and assigns Object.prototype.polluted = "yes".