Advanced Web, API & Modern Stack

Prototype Pollution (Node.js) — Concept + Live Lab

Poison Object.prototype so every object inherits attacker-controlled props.

Advanced · 15 min · Hands-on lab

Prototype pollution is a JavaScript-specific bug. In JS, objects inherit from Object.prototype. If an attacker can set a property via the special __proto__ key, they modify that shared prototype — so EVERY object in the app suddenly has that property. This can flip access checks, inject config, or even lead to RCE.

{ "__proto__": { "isAdmin": true } }

After a vulnerable deep-merge processes that input, any code that checks obj.isAdmin (on an object that didn't set it) now reads true from the polluted prototype. The classic sink is an unsafe recursive merge/clone that doesn't reject __proto__ / constructor / prototype keys.

Common sources — JSON body merges, query-string parsers, config loaders.
Impact — auth bypass, DoS, and gadget chains to RCE in Node apps.
Hunt in — lodash.merge (old versions), custom deep-merge, and libraries handling nested user input.

Take the quiz and try the live lab →