The form-data-objectizer npm package prior to version 1.0.1 contains a prototype pollution vulnerability. The library converts FormData to objects by walking bracket-notation form keys into nested objects without properly filtering dangerous properties like __proto__, constructor, or prototype. An attacker can exploit this by submitting HTTP form fields with names starting with __proto__[...], which causes the library to mutate Object.prototype and affects the entire Node.js process. This represents a critical security flaw that can lead to application-wide compromise. The vulnerability has been fixed in version 1.0.1.