AIKIDO-2026-10822

TL;DR

The formDataToJSON helper turns dotted multipart names into nested objects using a walk over intermediate path segments. When the runtime already has a polluted Object.prototype, the old property check could follow inherited slots so writes attached to shared prototype state instead of own properties on the result. Replacing that check with an own-property guard shadows inherited keys locally and stops global prototype mutation for attacker-shaped field names. A regression test pins the polluted-prototype scenario.