Prototype pollution is a JavaScript vulnerability that lets attackers inject properties into the base Object prototype, potentially leading to remote code execution. Here's the complete guide.
Anay Pandya
1,513 words
Anay Pandya
Founder of ZeriFlow · 10 years fullstack engineering · About the author
Key Takeaways
Prototype pollution is a class of JavaScript vulnerability where an attacker can inject properties into the global Object.prototype, affecting every object in the application and potentially enabling property injection, denial of service, or even remote code execution. If you're building Node.js backends or complex front-end applications, understanding prototype pollution is non-negotiable.
<div class="zf-stat-callout" style="background:#0d1117;border:1px solid rgba(16,185,129,0.25);border-left:3px solid #10b981;border-radius:4px;padding:16px 20px;margin:24px 0"> <p style="margin:0 0 4px;font-size:10px;font-weight:700;text-transform:uppercase;letter-spacing:0.15em;color:#10b981;font-family:monospace">ZeriFlow Data — 12,400+ sites analyzed</p> <p style="margin:0;font-size:13px;color:#e2e8f0;line-height:1.6;font-family:monospace">In ZeriFlow's dataset of 12,400+ scanned sites, the average security score is 52/100 — with 68% failing at least one critical check in categories including TLS configuration, , DNS authentication, and cookie handling.</p> </div>
Keep reading
Is your site actually secure?
Run a free check — 60 seconds
To understand prototype pollution, you first need to understand JavaScript's prototype chain. Every JavaScript object has an internal link to a prototype object. When you access a property on an object, JavaScript walks up the prototype chain until it finds the property or reaches null.
const obj = {};
console.log(obj.toString); // inherited from Object.prototypeThis means Object.prototype is the root of every object in JavaScript. Any property added to Object.prototype becomes accessible on every plain object in the runtime.
Prototype pollution occurs when an attacker controls user-supplied input that is used to set properties on objects using bracket notation or recursive merge/clone functions — and can craft that input to target __proto__, constructor, or constructor.prototype.
The classic attack vector:
const userInput = JSON.parse('{"__proto__": {"admin": true}}');
const merged = Object.assign({}, userInput);
const target = {};
console.log(target.admin); // true — Object.prototype was pollutedAfter the merge, Object.prototype.admin is true. Every newly created plain object now has an admin property, even objects that should be unprivileged.
__proto__The most direct path. If a recursive merge function processes __proto__ as a key:
function merge(target, source) {
for (let key in source) {
if (typeof source[key] === 'object') {
if (!target[key]) target[key] = {};
merge(target[key], source[key]);
} else {
target[key] = source[key];
}
}
}
merge({}, JSON.parse('{"__proto__":{"polluted":"yes"}}'));
console.log({}.polluted); // 'yes'constructor.prototypeA secondary path that bypasses __proto__ filters:
merge({}, JSON.parse('{"constructor":{"prototype":{"polluted":"yes"}}}'));
console.log({}.polluted); // 'yes'Many popular libraries had prototype pollution vulnerabilities historically: lodash (CVE-2019-10744), jquery (CVE-2019-11358), hoek, merge, deep-extend. A malicious payload passed to a deep clone or deep merge function in an older version of these libraries could pollute the prototype.
Prototype pollution becomes truly critical when it can be escalated to RCE. This happens when application code uses object properties to make security decisions or build system commands — and those properties can be set via prototype pollution.
A famous example from Node.js applications using child_process:
// Attacker pollutes: {"__proto__": {"shell": true, "env": {"NODE_OPTIONS": "--require /tmp/malicious.js"}}}
const options = {}; // inherits shell: true and env from prototype
const result = child_process.execFile('/usr/bin/node', ['script.js'], options);
// NODE_OPTIONS causes Node to require the attacker's fileCVE-2022-21824 (Node.js console.table) is a real-world example where prototype pollution in the standard library led to exploitable conditions.
_.defaultsDeep, _.merge, _.mergeWith: prototype pollution via user-controlled keys. Affected millions of projects.$.extend deep merge: prototype pollution leading to XSS in applications using the result in DOM operations._.zipObjectDeep: another prototype pollution via controlled key names.console.table could be exploited via crafted object iteration.These are not theoretical bugs. They affected production systems at scale.
Inject the following payloads into any endpoint that accepts JSON or object-like input:
{"__proto__": {"testprop": "polluted"}}
{"constructor": {"prototype": {"testprop": "polluted"}}}Then check whether {}.testprop returns 'polluted' in the application context. Browser DevTools or server-side logging can reveal this.
Tools like @nicolo-ribaudo/semver-store audits, snyk, and DAST scanners can identify vulnerable merge patterns. Static analysis tools like ESLint with security plugins can flag unsafe key assignments.
The nuclear option — prevents any modification to the base prototype:
Object.freeze(Object.prototype);This is highly effective but can break some third-party libraries. Test thoroughly before applying in production.
Create objects with no prototype at all for data storage and lookup maps:
const safeMap = Object.create(null);
// safeMap has no __proto__, constructor, or any inherited properties
safeMap['userInput'] = value; // safeThis is the recommended pattern for any object used as a key-value store with untrusted keys.
Explicitly block dangerous keys in merge/clone functions:
const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
function safeMerge(target, source) {
for (let key in source) {
if (DANGEROUS_KEYS.has(key)) continue;
if (typeof source[key] === 'object') {
if (!target[key]) target[key] = {};
safeMerge(target[key], source[key]);
} else {
target[key] = source[key];
}
}
}When iterating object properties, always use hasOwnProperty or Object.hasOwn to avoid traversing the prototype chain with untrusted data:
for (const key in source) {
if (Object.hasOwn(source, key)) {
// process key
}
}The majority of real-world prototype pollution attacks target library vulnerabilities. Run npm audit regularly, use snyk or Dependabot, and upgrade lodash, jQuery, and merge utilities to patched versions immediately.
Node.js 22+ includes additional hardening options. Running with --frozen-intrinsics freezes all built-in objects, including Object.prototype. This is the most comprehensive defense for production Node.js services.
Additionally, consider using a schema validation layer (Joi, Zod, Ajv) on all incoming JSON. If your schema doesn't allow __proto__ as a key, the payload never reaches your merge functions.
Prototype pollution is fundamentally a code-level vulnerability, but your application's overall security posture — including the headers, configurations, and dependency hygiene that automated scanners assess — directly affects how exploitable these flaws are.
A: No. Prototype pollution affects both client-side JavaScript and Node.js. In browsers, polluted prototypes can lead to XSS or DOM-based attacks if the polluted properties influence DOM manipulation code. In Node.js, the impact can escalate to RCE.
A: Partially. TypeScript's type system can prevent some accidental property assignments at compile time, but TypeScript doesn't exist at runtime. Malicious JSON input bypasses TypeScript entirely. You still need runtime defenses like Object.freeze or key sanitization.
A: Native JSON.parse in modern browsers and Node.js does not set __proto__ on the parsed object — it creates a literal key called __proto__. However, when that parsed object is passed to a vulnerable merge function, the merge function walks the key chain and sets it on the prototype. The bug is in the merge, not the parse.
A: These terms are often used interchangeably in security contexts. 'Prototype pollution' is the more widely used and standardized term in the security community (used by OWASP and CVE descriptions). Both refer to the same class of vulnerability.
A: Historically: lodash (multiple CVEs), jquery, hoek, merge, deep-extend, node-forge, immer, and minimist. Always check npm audit and review your dependency tree for these packages, especially older versions.
Prototype pollution is a subtle but high-impact vulnerability class that exploits one of JavaScript's most fundamental design decisions. The key defenses are simple in principle: freeze the prototype, use Object.create(null) for maps, sanitize merge keys, and keep your dependencies updated.
As JavaScript applications grow more complex and rely on more third-party libraries, the attack surface for prototype pollution grows with it. Building these defenses into your standard coding patterns — not as an afterthought — is the right approach.
<!-- zf-internal-links -->
Related resources
Website Vulnerability Scanner
Run a broader website security audit across headers, TLS, DNS, cookies, SEO, and disclosure checks.
Security Headers Checker
Check CSP, HSTS, X-Frame-Options, and other response headers.
SSL Checker
Review TLS certificate, HTTPS, and transport security signals.
DMARC Checker
Validate email authentication records for domain spoofing protection.
CSP Checker
Review Content-Security-Policy coverage and common gaps.
June 24, 2026
Best Security Tools for AI Startups
Monitor your security score
Schedule recurring scans and catch regressions after deployments.