What Is Prototype Pollution?
Prototype pollution is a JavaScript-specific vulnerability where attacker-controlled input
corrupts the prototype that other objects inherit from. Because almost every object in JavaScript
inherits from Object.prototype, injecting a property there makes it silently appear on objects
throughout the application — a subtle, far-reaching form of injection unique to the language.
How does it happen?#
The usual trigger is unsafe recursive merging or property assignment from untrusted input, where a
key like __proto__ is treated as a normal property name:
Attacker input: { "__proto__": { "isAdmin": true } }
Naive deep-merge writes to Object.prototype
Now ({}).isAdmin === true for every objectSuddenly objects that never set isAdmin report it as true. Depending on how the app reads
properties, that can bypass checks, alter configuration, or feed a dangerous sink.
What can it lead to?#
| Impact | Path |
|---|---|
| Denial of service | Polluting properties the app relies on |
| Authorization bypass | Injecting flags like isAdmin |
| DOM XSS | Polluted value reaching an HTML sink |
| Remote code execution | Server-side gadget chains in Node.js |
How do you prevent it?#
- Reject dangerous keys — filter
__proto__,constructor,prototypefrom input. - Use safe data structures —
Mapinstead of plain objects for untrusted key/value data. - Freeze prototypes —
Object.freeze(Object.prototype)where feasible. - Use vetted merge utilities — libraries hardened against pollution; keep dependencies patched.
Prototype pollution is injection aimed at JavaScript’s object model. More at the Web Security hub.
Frequently asked questions#
What is prototype pollution?
Prototype pollution is a JavaScript vulnerability where an attacker sets properties on Object.prototype (or another base prototype) via specially crafted keys like __proto__. Because nearly every object inherits from that prototype, the injected property appears on objects across the whole application, changing behavior in ways the attacker can exploit.
What can prototype pollution lead to?
Consequences range from denial of service and property tampering to, in the worst cases, remote code execution when a polluted property flows into a dangerous sink. On the client it can enable DOM XSS; on Node.js servers it has been chained into command execution. The impact depends on how the app uses object properties downstream.