Prototype pollution

Prototype pollution in plain words

Prototype pollution is a data-to-prototype bug. Untrusted input contains a key such as __proto__, constructor, or prototype. A merge, parser, or path setter treats that key like normal data and writes to a shared prototype. Later, ordinary property lookup makes fresh objects appear to have attacker-chosen defaults.

In one sentence: merging untrusted objects can change every object that inherits from the polluted prototype. This lesson builds on the prototype chain, Object.create, built-in prototypes, freezing and sealing, JSON, classic utilities, Map & Set, property descriptors, and XSS.

Property lookup checks an object first. If the property is missing, lookup walks the object's [[Prototype]] link. Most ordinary objects eventually reach Object.prototype. Add a property there and ({}).isAdmin can read it even though the fresh object owns nothing.

The legacy __proto__ accessor normally lives on Object.prototype. Reading obj["__proto__"] can return the object's prototype. Assigning obj["__proto__"] = other can change that one object's prototype. A deep merge is more dangerous: it may read the prototype and then recursively write into it.

1const defaults = { isAdmin: true };2const requestConfig = Object.create(defaults);3 4console.log(requestConfig.isAdmin);5console.log(Object.hasOwn(requestConfig, "isAdmin"));

Line 1 creates an object that inherits isAdmin. Line 4 uses Object.hasOwn to reject that inherited flag. Authorization, feature flags, and configuration fallbacks should make that distinction explicit.

JSON.parse does not call the __proto__ accessor. It creates an own data property whose name is literally "__proto__". That parsed object is not polluted. The danger starts later when a naive merge copies that own property with assignment or recursively merges into target["__proto__"].

1function isObjectLike(value) {2  return value !== null && (typeof value === "object" || typeof value === "function");3}4function unsafeMerge(target, source) {5  for (const key of Object.keys(source)) {6    const value = source[key];7    if (isObjectLike(value) && isObjectLike(target[key])) {8      unsafeMerge(target[key], value);9    } else {10      target[key] = value;11    }12  }13  return target;14}15 16const parsed = JSON.parse('{"__proto__":{"isAdmin":true}}');17console.log(Object.hasOwn(parsed, "__proto__"));18console.log(Object.getPrototypeOf(parsed) === Object.prototype);19console.log(({}).isAdmin);20try {21  unsafeMerge({}, parsed);22  console.log(({}).isAdmin);23} finally {24  delete Object.prototype.isAdmin;25}

The first two logs prove the exact behavior: the parsed value owns the __proto__ property, and its real prototype is still Object.prototype. The third log is undefined. Only after unsafeMerge does a fresh object read true through the polluted prototype. The finally block cleans up the demo property.

1function isObjectLike(value) {2  return value !== null && (typeof value === "object" || typeof value === "function");3}4function unsafeMerge(target, source) {5  for (const key of Object.keys(source)) {6    const value = source[key];7    if (isObjectLike(value) && isObjectLike(target[key])) {8      unsafeMerge(target[key], value);9    } else {10      target[key] = value;11    }12  }13  return target;14}15const sandboxPrototype = {};Run16const target = Object.create(sandboxPrototype);17const payload = JSON.parse('{"__proto__":{"isAdmin":true}}');18unsafeMerge(target, payload);19const fresh = Object.create(sandboxPrototype);20console.log(fresh.isAdmin);

1function isObjectLike(value) {2  return value !== null && (typeof value === "object" || typeof value === "function");3}4function unsafeMerge(target, source) {5  for (const key of Object.keys(source)) {6    const value = source[key];7    if (isObjectLike(value) && isObjectLike(target[key])) {8      unsafeMerge(target[key], value);9    } else {10      target[key] = value;11    }12  }13  return target;14}15const sandboxPrototype = {};16const target = Object.create(sandboxPrototype);17const payload = JSON.parse('{"__proto__":{"isAdmin":true}}');18unsafeMerge(target, payload);19const fresh = Object.create(sandboxPrototype);20console.log(fresh.isAdmin);

The vulnerable pattern is small: obj[key] = value or merge(target[key], value) while key comes from input. A single __proto__ key is one route. The nested constructor.prototype route is another: a naive merge may follow inherited constructor to Object, then prototype to Object.prototype.

1function setByPath(target, path, value) {2  const parts = path.split(".");3  let current = target;4  for (const part of parts.slice(0, -1)) {5    if (current[part] == null) current[part] = {};6    current = current[part];7  }8  current[parts.at(-1)] = value;9  return target;10}11 12try {13  setByPath({}, "a.__proto__.polluted", true);14  console.log(({}).polluted);15} finally {16  delete Object.prototype.polluted;17}

Set-by-path helpers, form parsers, and query-string parsers often turn text into segments. A URL shape such as ?__proto__[isAdmin]=1 or a path such as a.__proto__.polluted is dangerous if the parser builds objects by assignment without filtering each segment.

1function isObjectLike(value) {2  return value !== null && (typeof value === "object" || typeof value === "function");3}4function unsafeMerge(target, source) {5  for (const key of Object.keys(source)) {6    const value = source[key];7    if (isObjectLike(value) && isObjectLike(target[key])) {8      unsafeMerge(target[key], value);9    } else {10      target[key] = value;11    }12  }13}14 15try {16  unsafeMerge({}, JSON.parse('{"constructor":{"prototype":{"polluted":"yes"}}}'));17  console.log(({}).polluted);18} finally {19  delete Object.prototype.polluted;20}

Blocking only __proto__ is incomplete. A safe merge treats __proto__, constructor, and prototype as dangerous at every depth, before it reads from the target.

A hardened merge does three boring things. First, it rejects dangerous keys and path segments before any target lookup. Second, it treats untrusted input as schema-validated data, not as arbitrary object shape. Third, it reads security decisions with own-property checks.

1const dangerousKeys = new Set(["__proto__", "constructor", "prototype"]);Run2function isPlainObject(value) {3  return value !== null && typeof value === "object" && !Array.isArray(value);4}5function safeMerge(target, source) {6  for (const key of Object.keys(source)) {7    if (dangerousKeys.has(key)) continue;8    const value = source[key];9    if (isPlainObject(value)) {10      const current = Object.hasOwn(target, key) ? target[key] : undefined;11      target[key] = safeMerge(isPlainObject(current) ? current : {}, value);12    } else {13      target[key] = value;14    }15  }16  return target;17}18const sandboxPrototype = {};19const target = Object.create(sandboxPrototype);20const payload = JSON.parse('{"__proto__":{"isAdmin":true}}');21safeMerge(target, payload);22const fresh = Object.create(sandboxPrototype);23console.log(fresh.isAdmin);24console.log(Object.hasOwn(target, "__proto__"));

1const dangerousKeys = new Set(["__proto__", "constructor", "prototype"]);2function safeSetByPath(target, path, value) {3  const parts = path.split(".");4  if (parts.some((part) => dangerousKeys.has(part))) return false;5  let current = target;6  for (const part of parts.slice(0, -1)) {7    if (!Object.hasOwn(current, part) || typeof current[part] !== "object") current[part] = {};8    current = current[part];9  }10  current[parts.at(-1)] = value;11  return true;12}13 14const target = {};15console.log(safeSetByPath(target, "a.__proto__.polluted", true));16console.log(({}).polluted);

structuredClone can copy data without invoking setters on the target because it creates a fresh clone, but it is not validation. A JSON reviver can drop dangerous keys while parsing. Schema validation should reject unknown fields before they reach merge or path code.

Sometimes the safest fix is to stop using a plain object as an open-ended dictionary. A null-prototype object has no inherited toString, no inherited constructor, and no inherited __proto__ accessor. That means the dangerous-looking names are just own keys. The trade-off is also real: there is no inherited toString or hasOwnProperty, so use static helpers such as Object.entries and Object.hasOwn.

1const dict = Object.create(null);2dict["__proto__"] = "kept as data";3dict.constructor = "also data";4 5console.log(dict["__proto__"]);6console.log("toString" in dict);7console.log(JSON.stringify(dict));

A Map is often clearer for user-supplied key/value data. It does not use property lookup for entries, accepts non-string keys, has get, set, has, delete, and size, and keeps insertion order explicit.

1const flags = new Map();2flags.set("__proto__", "kept as data");3flags.set("constructor", "also data");4 5console.log(flags.get("__proto__"));6console.log(({}).polluted);

Freezing prototypes and Node flags

Object.freeze(Object.prototype) can make direct pollution attempts fail because the shared prototype is no longer extensible or writable for its data properties. Some locked-down apps do this very early, before application code runs. The risk is compatibility: old libraries, polyfills, tests, or instrumentation that patch built-in prototypes may break. Freezing is defense in depth, not a substitute for safe merge code.

1node --disable-proto=delete server.js2node --disable-proto=throw server.js

Use runtime flags and frozen prototypes only when you control compatibility. Keep the main fixes in code: schema validation, filtered keys, own-property reads, null-prototype dictionaries, and Map where a map is the real data model.

Prototype pollution impact depends on what the application reads later. The simplest bug is authorization bypass: code checks if (user.isAdmin) and a polluted default supplies true. Denial of service can happen when polluted methods, types, or options make code throw or recurse. Gadget chains are worse: a polluted option may flow into a template, sanitizer, command runner, or server-side framework and become XSS or remote code execution. Treat those as conceptual risks and audit each gadget path rather than assuming every pollution is instantly exploitable.

Citation trail: NVD CVE-2018-3721 and GitHub Advisory CVE-2018-16487 for lodash merge/defaultsDeep, NVD CVE-2019-11358 for jQuery.extend, NVD CVE-2020-7598 for minimist, and GitHub Advisory CVE-2022-23529 for qs.

Common misconceptions

• “JSON.parse pollutes by itself.” No. It creates an own __proto__ data property. Assignment during merge is the dangerous step.
• “Block only __proto__.” Also block constructor and prototype at every depth.
• “A null-prototype object is always better.” It is better for dictionaries with untrusted keys, but plain records with known fields remain readable and natural.
• “Freezing prototypes fixes the app.” It is a guardrail with compatibility costs. Unsafe merge code still needs to be fixed.
• “CVE means every app using the package had RCE.” The library bug creates the primitive. Exploitability depends on reachable input and useful gadget code.
• “Checking `config.isAdmin` is fine because the config is small.” Security decisions should require own data or validated defaults.

For each question, name the object that receives the write, then ask whether later code reads own data or inherited data.

Key takeaways

• Prototype pollution is a property-write bug that turns input keys into inherited defaults.
• JSON.parse creates an own __proto__ data property; unsafe assignment or deep merge makes it dangerous.
• Block __proto__, constructor, and prototype before any target lookup in merge and path helpers.
• Use Object.hasOwn for security decisions, and prefer Object.create(null) or Map for user-key dictionaries.
• Freezing prototypes and Node's --disable-proto flags are defense in depth with compatibility limits.

Up next: supply-chain security, where the same defensive mindset moves from object keys to the packages you install.