Prototype pollution is a JavaScript vulnerability in which attacker-controlled data adds or changes properties on an object prototype. Because JavaScript looks up missing properties through the prototype chain, a polluted shared prototype can influence many objects in the same runtime. That does not automatically compromise an application: damage depends on whether reachable code later reads the polluted property and uses it in a sensitive operation.
How prototype pollution works
JavaScript objects can inherit properties from other objects through a prototype chain. If an ordinary object does not contain a requested property, JavaScript may find it on one of its prototypes instead. A property added to a widely shared prototype can therefore appear to be present on many objects that never received it directly. MDN explains this behavior in its prototype pollution security article.
As an Amazon Associate I earn from qualifying purchases.
The vulnerability commonly starts when an application processes attacker-controlled keys with a recursive merge, clone, dynamic assignment, or path-setting helper. Special key segments such as __proto__, constructor, and prototype can steer some operations toward a prototype rather than an ordinary data field. The risk is not that these strings are intrinsically executable; it is that unsafe code may treat them as paths to objects that influence other property lookups.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Source and gadget are separate stages
A source is the untrusted input and the code path that lets its keys reach a prototype. A gadget is application or dependency code that later reads an inherited attacker-controlled value and uses it in a consequential way. OWASP notes that pollution alone rarely causes harm directly; impact depends on a suitable gadget and the affected runtime and code path. See the OWASP Web Security Testing Guide.
Why the effects can spread across an application
When a polluted property sits on a shared prototype, unrelated objects inheriting from it may resolve that property even though it is not their own. This can affect code that treats an absent setting as safe, or that trusts a configuration or authorization property without checking where it came from. MDN illustrates possible effects on fetch() request options and authorization logic. These are examples of potential gadgets, not behavior present in every application.
Browser applications
In a browser, a reachable gadget may contribute to DOM-based cross-site scripting or bypass a client-side defense, according to OWASP. The outcome depends on how the application consumes the inherited value; pollution by itself does not guarantee script execution or a defense bypass.
Rank #2
Node.js applications
OWASP describes possible Node.js consequences ranging from denial of service and security-logic bypass to remote code execution. These outcomes require suitable vulnerable code paths and gadgets; they should not be read as automatic consequences of every prototype pollution flaw.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to reduce the risk
Use multiple controls: prevent unsafe keys from reaching prototype-changing operations, avoid inherited values for security decisions, and limit the impact if a source is missed. The right combination depends on the application and its dependencies.
Rank #3
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
| Control | What it addresses | Scope and trade-off |
|---|---|---|
| Strict input schemas and explicit defaults | Rejects unexpected structured input and avoids relying on a missing property for an important value. | Useful in browsers and Node.js; schemas must match the fields the application actually accepts. |
| Reject dangerous key segments | Blocks keys such as __proto__, constructor, and prototype before dynamic assignment or path processing. |
Addresses a common pollution source, but does not replace safe handling of dictionaries and property reads. |
Map or null-prototype dictionary |
Provides safer storage for untrusted dictionary keys. For object dictionaries, Object.create(null) creates an object that does not inherit from Object.prototype. |
Applies where dictionary semantics are needed; code expecting ordinary object methods or inheritance may need adaptation. |
| Own-property checks and safer enumeration | Prevents security-sensitive reads from silently accepting inherited values. Use Object.hasOwn() where appropriate; prefer Object.keys() or for...of over relevant for...in patterns. |
Protects consuming code, but does not stop a pollution source from changing a prototype. |
| Freeze built-in prototypes | Can prevent modification of built-in prototypes. | Defense in depth for compatible applications; it may break application or dependency code that expects to modify built-ins. |
Node.js --disable-proto option |
--disable-proto=delete removes the __proto__ accessor; --disable-proto=throw makes accesses throw. |
Node.js runtime hardening only. It does not remove the separate constructor.prototype route, so it is not a substitute for rejecting dangerous keys and using safe data structures. |
| Dependency updates and advisory checks | Reduces exposure to known flaws in utilities that merge or copy object properties. | Keep versions current and check relevant advisories; this does not by itself establish that application-specific code is safe. |
How to investigate a possible vulnerability
- Trace untrusted input. Follow values from request parsers and other external sources into recursive merges, clones, dynamic assignments, and path-based setters.
- Check whether a prototype is reachable. Review how each helper handles dangerous key segments and whether input can alter a prototype rather than only creating an ordinary field.
- Find reachable gadgets. Search application and dependency code for sensitive reads that may accept inherited configuration, authorization, or request-option values. Assess the specific runtime and code path rather than treating a polluted property as proof of impact.
- Review dependencies. Check versions against relevant security advisories, especially for utilities that merge or copy object properties.
- Test in an authorized environment. OWASP lists Burp Suite for intercepting requests and crafting JSON payloads during server-side testing, and DOM Invader for automated client-side source and gadget discovery. OWASP also identifies ppmap and ppfuzz as related tools. Tool output can help locate leads, but confirming reachability and impact still requires examining application code.
What the classification and published research establish
MITRE classifies the weakness as CWE-1321: Improperly Controlled Modification of Object Prototype Attributes. A 2023 USENIX Security Symposium paper, “Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js”, describes a multi-stage framework using multi-label static taint analysis to identify prototype pollution in Node.js libraries and applications, along with a hybrid approach to identify universal gadgets. It demonstrates research into concrete Node.js remote-code-execution paths and detection methods; it does not establish a general prevalence or incident rate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
