Prototype pollution

Prototype pollution in plain words

Most JavaScript objects have a prototype. A prototype is another object that JavaScript checks when an object doesn't have a property itself. Many objects can share one prototype.

Prototype pollution is a bug where outside data adds a property to a shared prototype. It happens in three steps:

• Input from a user contains a special key, such as __proto__, constructor, or prototype.
• A helper copies that input into an object. It treats the special key like any other key.
• The copy lands on the shared prototype. Now every object that uses that prototype seems to have the new property.

The helper might be a merge (code that copies keys from one object into another), a parser, or a function that sets a value by its path, like "a.b.c".

In one sentence: copying keys from outside data into objects can change every object that shares the polluted prototype. This lesson uses ideas from the prototype chain, Object.create, built-in prototypes, freezing and sealing, JSON, classic utilities, Map & Set, property descriptors, and XSS.

When you read a property, JavaScript looks in two places, in order:

1. First it looks on the object itself.
2. If the property is not there, it looks on the object's prototype, then that prototype's prototype, and so on. This line of objects is the prototype chain.

Almost every plain object ends its chain at Object.prototype. So if a property is added to Object.prototype, an empty object like {} can read it too. A property found this way is inherited. A property the object has itself is an own property.

The special key __proto__ makes this risky. It is an old accessor: a property that runs code when you read or write it. It lives on Object.prototype, so plain objects inherit it.

• Reading obj["__proto__"] gives back the object's prototype.
• Writing obj["__proto__"] = other changes that one object's prototype to other.
• A deep merge (a merge that also merges objects nested inside) is worse. It can read the prototype and then write new properties into it.

The next example shows why an inherited value is a problem for a permission check.

1const defaults = { isAdmin: true };2const requestConfig = Object.create(defaults);3 4console.log(requestConfig.isAdmin);5console.log(Object.hasOwn(requestConfig, "isAdmin"));

Line 1 makes a defaults object with isAdmin: true. Line 2 uses Object.create(defaults) to make requestConfig, a new empty object whose prototype is defaults. Line 4 prints true, because the read finds isAdmin on the prototype. Line 5 asks Object.hasOwn(requestConfig, "isAdmin"): "does this object have isAdmin itself?" It prints false.

So a plain read can't tell you where a value came from. For permission checks and settings, check that the property is the object's own.

The in operator doesn't help here. It also looks along the prototype chain, so it can't tell own from inherited. Line 2 finds role on the prototype and prints true. Line 3 checks only the object itself and prints false.

1const config = Object.create({ role: "admin" });2console.log("role" in config);3console.log(Object.hasOwn(config, "role"));

Attack input often arrives as JSON text. JSON.parse turns that text into an object. When the text has a key named "__proto__", JSON.parse does not run the __proto__ accessor. It just makes a normal own property whose name is "__proto__".

So the parsed object is not polluted. The danger starts later, when a merge copies that key into another object. The example below has two parts:

• Lines 1 to 14 define unsafeMerge, a deep merge with no safety checks.
• Lines 16 to 25 parse the input, check it, merge it, and clean up.

1function isObjectLike(value) {2  return value !== null && (typeof value === "object" || typeof value === "function");3}4function unsafeMerge(target, source) {5  for (const key of Object.keys(source)) {6    const value = source[key];7    if (isObjectLike(value) && isObjectLike(target[key])) {8      unsafeMerge(target[key], value);9    } else {10      target[key] = value;11    }12  }13  return target;14}15 16const parsed = JSON.parse('{"__proto__":{"isAdmin":true}}');17console.log(Object.hasOwn(parsed, "__proto__"));18console.log(Object.getPrototypeOf(parsed) === Object.prototype);19console.log(({}).isAdmin);20try {21  unsafeMerge({}, parsed);22  console.log(({}).isAdmin);23} finally {24  delete Object.prototype.isAdmin;25}

Here is what each highlighted line does:

• Line 16 parses the text into parsed.
• Line 17 prints true: parsed has its own key named __proto__.
• Line 18 prints true: the prototype of parsed is still the normal Object.prototype.
• Line 19 prints undefined: an empty object has no isAdmin yet.
• Line 21 runs unsafeMerge. It follows the __proto__ key into Object.prototype and writes isAdmin: true there.
• Line 22 prints true: now every empty object reads isAdmin from the prototype.
• Line 24, in the finally block, deletes the property again.

Object.assign is a related trap. It copies each key with a normal write, like target[key] = value. A normal write of __proto__ runs the accessor, so it changes the prototype of target. It does not change Object.prototype. Here is what happens:

• Line 4 copies the input into target.
• Line 5 prints true, and line 6 prints false: target can read isAdmin, but it doesn't own it.
• Line 7 prints false: the prototype of target is no longer Object.prototype.
• Line 8 prints undefined: other plain objects are not affected.
• Line 10, in finally, puts the normal prototype back, so line 12 prints undefined.

1const payload = JSON.parse('{"__proto__":{"isAdmin":true}}');2const target = {};3try {4  Object.assign(target, payload);5  console.log(target.isAdmin);6  console.log(Object.hasOwn(target, "isAdmin"));7  console.log(Object.getPrototypeOf(target) === Object.prototype);8  console.log(({}).isAdmin);9} finally {10  Object.setPrototypeOf(target, Object.prototype);11}12console.log(target.isAdmin);

Now step through an unsafe merge one line at a time. This version uses its own small prototype object, called sandboxPrototype, instead of the real Object.prototype.

1function isObjectLike(value) {2  return value !== null && (typeof value === "object" || typeof value === "function");3}4function unsafeMerge(target, source) {5  for (const key of Object.keys(source)) {6    const value = source[key];7    if (isObjectLike(value) && isObjectLike(target[key])) {8      unsafeMerge(target[key], value);9    } else {10      target[key] = value;11    }12  }13  return target;14}15const sandboxPrototype = {};Run16const target = Object.create(sandboxPrototype);17const payload = JSON.parse('{"__proto__":{"isAdmin":true}}');18unsafeMerge(target, payload);19const fresh = Object.create(sandboxPrototype);20console.log(fresh.isAdmin);

In the playground, pick a merge and run it. It runs inside a hidden iframe, which has its own Object.prototype, so this page stays clean.

1function isObjectLike(value) {2  return value !== null && (typeof value === "object" || typeof value === "function");3}4function unsafeMerge(target, source) {5  for (const key of Object.keys(source)) {6    const value = source[key];7    if (isObjectLike(value) && isObjectLike(target[key])) {8      unsafeMerge(target[key], value);9    } else {10      target[key] = value;11    }12  }13  return target;14}15const sandboxPrototype = {};16const target = Object.create(sandboxPrototype);17const payload = JSON.parse('{"__proto__":{"isAdmin":true}}');18unsafeMerge(target, payload);19const fresh = Object.create(sandboxPrototype);20console.log(fresh.isAdmin);

The unsafe code is usually small. It is one of these two lines, where key comes from the input:

• obj[key] = value, a write with a key chosen by the input.
• merge(target[key], value), a deep merge into whatever target[key] gives back.

A path setter is a helper that sets a nested value from a text path. For example, setByPath(obj, "a.b", 1) sets obj.a.b to 1. It splits the path at each dot into segments ("a", "b") and walks them one by one.

1function setByPath(target, path, value) {2  const parts = path.split(".");3  let current = target;4  for (const part of parts.slice(0, -1)) {5    if (current[part] == null) current[part] = {};6    current = current[part];7  }8  current[parts.at(-1)] = value;9  return target;10}11 12try {13  setByPath({}, "a.__proto__.polluted", true);14  console.log(({}).polluted);15} finally {16  delete Object.prototype.polluted;17}

Line 13 calls setByPath with the path "a.__proto__.polluted". Here is the walk:

1. Segment a: nothing is there yet, so line 5 makes a new empty object, and line 6 moves into it.
2. Segment __proto__: reading it gives back that object's prototype, Object.prototype. It isn't missing, so line 5 makes nothing new, and line 6 moves into it.
3. Segment polluted: line 8 writes true onto Object.prototype.

Line 14 prints true for an empty object. Line 16 deletes the property again.

Form parsers and URL query parsers often build objects the same way. A URL like ?__proto__[isAdmin]=1 or a path like a.__proto__.polluted is dangerous if the parser writes each segment without checking it.

Brackets and dots can name the same property: profile[__proto__] means the same as profile.__proto__. So turn the path into a clean list of segments first, then check each segment. This is called normalizing the path. The next example only checks a path; it never writes to an object.

• Line 1 starts with a bracket-style path for a profile field.
• Lines 2 to 5 turn each [ into a dot, remove each ], split at the dots, and drop empty parts.
• Line 7 prints the normalized path, profile.__proto__.isAdmin.
• Line 8 prints true: one segment is a blocked key, so the code can refuse before any write.

1const parts = "profile[__proto__][isAdmin]"2  .replaceAll("[", ".")3  .replaceAll("]", "")4  .split(".")5  .filter(Boolean);6const dangerousKeys = new Set(["__proto__", "constructor", "prototype"]);7console.log(parts.join("."));8console.log(parts.some((part) => dangerousKeys.has(part)));

Blocking only __proto__ is not enough. A second route uses constructor and then prototype:

• Every plain object inherits a constructor property. It points to the Object function.
• Object.prototype is the prototype property of that function.
• So the input {"constructor":{"prototype":{...}}} leads a careless deep merge straight to Object.prototype, if the merge also walks into functions. The isObjectLike check on line 2 lets it do that.

1function isObjectLike(value) {2  return value !== null && (typeof value === "object" || typeof value === "function");3}4function unsafeMerge(target, source) {5  for (const key of Object.keys(source)) {6    const value = source[key];7    if (isObjectLike(value) && isObjectLike(target[key])) {8      unsafeMerge(target[key], value);9    } else {10      target[key] = value;11    }12  }13}14 15try {16  unsafeMerge({}, JSON.parse('{"constructor":{"prototype":{"polluted":"yes"}}}'));17  console.log(({}).polluted);18} finally {19  delete Object.prototype.polluted;20}

Line 16 merges that input into an empty object. Line 17 prints yes: an empty object now reads polluted from Object.prototype. Line 19 deletes it again.

So a safe merge treats all three names as dangerous: __proto__, constructor, and prototype. It checks for them at every level of nesting, before it reads anything from the target.

A safe merge does three simple things:

1. It skips the dangerous keys (__proto__, constructor, prototype) before it reads anything from the target.
2. It only accepts input fields you expect. Checking input against a list of allowed fields and types is called schema validation.
3. When a value decides something important, it reads only own properties.

Step through the safe merge below. It gets the same input as the unsafe merge. Line 7 checks the key first. The key is __proto__, so the merge skips it.

1const dangerousKeys = new Set(["__proto__", "constructor", "prototype"]);Run2function isPlainObject(value) {3  return value !== null && typeof value === "object" && !Array.isArray(value);4}5function safeMerge(target, source) {6  for (const key of Object.keys(source)) {7    if (dangerousKeys.has(key)) continue;8    const value = source[key];9    if (isPlainObject(value)) {10      const current = Object.hasOwn(target, key) ? target[key] : undefined;11      target[key] = safeMerge(isPlainObject(current) ? current : {}, value);12    } else {13      target[key] = value;14    }15  }16  return target;17}18const sandboxPrototype = {};19const target = Object.create(sandboxPrototype);20const payload = JSON.parse('{"__proto__":{"isAdmin":true}}');21safeMerge(target, payload);22const fresh = Object.create(sandboxPrototype);23console.log(fresh.isAdmin);24console.log(Object.hasOwn(target, "__proto__"));

A path setter needs the same guard. In the next example, line 4 checks every segment before the walk starts. Line 15 prints false: the setter refused. Line 16 prints undefined: no object was polluted.

1const dangerousKeys = new Set(["__proto__", "constructor", "prototype"]);2function safeSetByPath(target, path, value) {3  const parts = path.split(".");4  if (parts.some((part) => dangerousKeys.has(part))) return false;5  let current = target;6  for (const part of parts.slice(0, -1)) {7    if (!Object.hasOwn(current, part) || typeof current[part] !== "object") current[part] = {};8    current = current[part];9  }10  current[parts.at(-1)] = value;11  return true;12}13 14const target = {};15console.log(safeSetByPath(target, "a.__proto__.polluted", true));16console.log(({}).polluted);

A few other tools can help, but none of them checks the input for you:

• structuredClone makes a fresh copy of data. It doesn't run the target's accessors, but it doesn't remove bad keys either.
• A reviver is a function you pass to JSON.parse. It can drop dangerous keys while the text is parsed.
• Schema validation should reject unknown fields before they reach any merge or path code.

A profile form should never choose its own permission fields. The next example uses an allowlist: a list of the only fields you accept.

• Line 1 parses input that tries to send isAdmin and __proto__.
• Line 2 allows only displayName.
• Line 3 makes the result with Object.create(null): an object with no prototype at all.
• Lines 4 to 8 copy a field only if it is allowed and its value is a string.
• Line 9 prints Asha. Line 10 prints false: isAdmin was not copied. Line 11 prints undefined: no prototype changed.

The allowlist guards the entry point. Lower-level merge and path helpers still need their own key checks, because data can reach them by other routes.

1const input = JSON.parse('{"displayName":"Asha","isAdmin":true,"__proto__":{"isAdmin":true}}');2const allowedFields = new Set(["displayName"]);3const profile = Object.create(null);4for (const key of Object.keys(input)) {5  if (allowedFields.has(key) && typeof input[key] === "string") {6    profile[key] = input[key];7  }8}9console.log(profile.displayName);10console.log(Object.hasOwn(profile, "isAdmin"));11console.log(({}).isAdmin);

Sometimes the safest fix is to stop using a plain object to store keys that users choose. Two other containers keep those keys as plain data.

The first is a null-prototype object, made with Object.create(null). It has no prototype, so it inherits nothing:

• No inherited __proto__ accessor, so __proto__ is just a normal key.
• No inherited constructor, so that is just a normal key too.
• No inherited toString or hasOwnProperty. Use the helpers on Object instead, such as Object.entries and Object.hasOwn.

1const dict = Object.create(null);2dict["__proto__"] = "kept as data";3dict.constructor = "also data";4 5console.log(dict["__proto__"]);6console.log("toString" in dict);7console.log(JSON.stringify(dict));

Line 1 makes dict with no prototype. Lines 2 and 3 store two values. Line 5 prints kept as data. Line 6 prints false: there is no toString to find. Line 7 prints both keys as JSON.

The second is a Map. A Map stores entries (key and value pairs) apart from its properties, so a key never reaches a prototype. It also has more to offer:

• Keys can be any value, not just strings.
• It has clear methods: get, set, has, delete, and a size property.
• It keeps entries in the order you added them.

1const flags = new Map();2flags.set("__proto__", "kept as data");3flags.set("constructor", "also data");4 5console.log(flags.get("__proto__"));6console.log(({}).polluted);

Line 5 prints kept as data. Line 6 prints undefined: no prototype changed.

A Map has one catch when you send data as JSON: JSON.stringify skips its entries. Line 1 stores a user key. Line 2 reads its value. Line 3 prints {}, an empty object. When you need JSON, convert the entries yourself. When the JSON comes back, check it again.

1const flags = new Map([["__proto__", "kept as data"]]);2console.log(flags.get("__proto__"));3console.log(JSON.stringify(flags));

The table compares four choices. Each row says what the choice is good for and what to watch out for.

Freezing prototypes and Node flags

Object.freeze(Object.prototype) locks the shared prototype. After that, nobody can add new properties to it or change its normal values, so direct pollution attempts fail. Some locked-down apps do this at the very start, before any other code runs.

The risk is that other code may stop working. Old libraries, polyfills (code that adds missing built-in features), tests, and monitoring tools sometimes change built-in prototypes on purpose. Freezing is an extra layer of protection. It does not replace a safe merge.

1node --disable-proto=delete server.js2node --disable-proto=throw server.js

Line 1 starts server.js in delete mode. Line 2 starts it in throw mode.

Use frozen prototypes and Node flags only when you know all your code still works with them. Keep the main fixes in your own code:

• Check input against the fields you allow.
• Skip the dangerous keys.
• Read own properties for important decisions.
• Store user-chosen keys in a null-prototype object or a Map.

How much harm pollution does depends on what the app reads later. Here are the main kinds of harm, from simplest to worst:

• Skipping a permission check. The code checks if (user.isAdmin), and a polluted value gives true.
• Denial of service. A polluted value makes code crash or loop forever, so the app stops working for everyone.
• A chain into worse bugs. A polluted setting flows into other code, such as a template, an HTML cleaner, or a command runner. This could lead to XSS, or to an attacker running commands on the server.

These are possible risks, not certain ones. For each case, follow the polluted value and see what code actually reads it.

A CVE is a public ID number for a known security bug. The table lists real prototype pollution bugs in popular libraries. Each row gives the library, the CVE number and year, and what the bug did.

Sources: NVD CVE-2018-3721 and GitHub Advisory CVE-2018-16487 for lodash merge/defaultsDeep, NVD CVE-2019-11358 for jQuery.extend, NVD CVE-2020-7598 for minimist, and NVD CVE-2022-24999 for qs.

To check your own app:

1. Find where keys from requests enter your code.
2. Find what important code reads those values later.
3. Check the versions of the packages you use, and the packages they use.
4. Update any affected package to a fixed version that is still supported.
5. Test your parser settings.

A CVE in a package you use does not prove your app has a permission bypass. It doesn't prove attackers can run commands either. It means you should check.

Common misconceptions

• "JSON.parse pollutes by itself." No. It makes a normal own key named __proto__. The merge that copies it is the dangerous step.
• "Blocking __proto__ is enough." No. Also block constructor and prototype, at every level of nesting.
• "A null-prototype object is always better." No. It is best for keys that users choose. For objects with fields your code knows, a plain object is easier to read.
• "Freezing prototypes fixes the app." No. It is an extra layer that can break other code. The unsafe merge still needs fixing.
• "A CVE means every app using the package can be taken over." No. The package bug lets pollution happen. Real harm depends on whether attackers can reach it and what code reads the polluted value.
• "Checking config.isAdmin is fine because the config is small." No. Size doesn't matter. Important decisions should read own properties or checked defaults.

These four defenses are easy to mix up. Each row says what one defense stops and what it can't do alone.

For each question, first find which object gets the write. Then ask: does the later read find an own value or an inherited one?

Key takeaways

• Prototype pollution is a bug where a key from the input makes a write land on a shared prototype. Then many objects read the new value.
• JSON.parse makes a normal own key named __proto__. It becomes dangerous only when an unsafe write or deep merge copies it.
• In merge and path helpers, skip __proto__, constructor, and prototype before reading anything from the target.
• Use Object.hasOwn for important decisions. Store user-chosen keys in Object.create(null) or a Map.
• Frozen prototypes and Node's --disable-proto flag are extra layers. They can break other code, and they don't replace safe helpers.

Up next: supply-chain security. It is about the same kind of care, but for the packages you install instead of the keys you copy.