CVE-2026-77078: Javascript Unguarded Attacker Key Append In Event Listenercve-2026-77078-javascript-unguarded-attacker-key-append-in-event-listener
An attacker-controlled field name ($NAME) received from a form/multipart event handler is passed to an append-style helper ($APPEND) without any exception handling. Helpers with this API parse bracketed keys (e.g. "items[4294967294]") into object paths and array indexes, and a crafted name pair can make the call throw synchronously (RangeError: Invalid array
