What is Prototype Pollution?

Prototype pollution is a JavaScript vulnerability in which an attacker changes properties on a shared inherited prototype. Other objects then appear to have these values. Depending on later code, the result can be authorization bypass, modified configuration, XSS or even server-side code execution.

Why are special keys dangerous?

JavaScript resolves missing properties through the prototype chain. Unsafe deep-merge and path helpers treat JSON keys as ordinary properties. __proto__ or constructor.prototype may therefore modify a prototype instead of a local value.

Simplified code example

Vulnerable:

function setPath(target, path, value) {
  const parts = path.split('.');
  let current = target;
  for (const part of parts.slice(0, -1)) {
    current = current[part] ??= {};
  }
  current[parts.at(-1)] = value;
}

setPath({}, 'constructor.prototype.isAdmin', true);
console.log(({}).isAdmin); // true

Safer: reject dangerous keys and allow only expected fields.

const BLOCKED_KEYS = new Set(['__proto__', 'prototype', 'constructor']);

function safeSet(target, path, value) {
  const parts = path.split('.');
  if (parts.some((part) => BLOCKED_KEYS.has(part))) {
    throw new Error('Unsafe property path');
  }
  // Also compare the path with a business allowlist.
}

A denylist is only a second boundary. Prefer a small positive schema with additionalProperties: false and avoid generic deep merges for untrusted data.

Client and server impact

Prevention and detection

• - Update dependencies and monitor transitive advisories.
• - Validate inputs against a schema and reject unknown properties.
• - Use Object.hasOwn() for security decisions.
• - Consider Object.create(null) or Map for pure dictionaries.
• - Test dangerous keys and unexpected inherited values.

Useful open-source tools

ppfuzz and PPMap help identify server- and client-side paths. OSV-Scanner and Trivy find affected dependencies. Scanners cannot identify every application-specific gadget; confirm in code and an isolated environment.