hardBackend

What is prototype pollution and how do you prevent it in Node.js?

Q: What is prototype pollution and how do you prevent it in Node.js?

**TL;DR.** **Prototype pollution** happens when untrusted input sets __proto__ / constructor / prototype keys during a **deep merge** or recursive assignment, injecting properties onto Object.prototype — affecting **every** object and enabling DoS, privilege escalation, or RCE. Prevent it by **rejecting those keys**, using Map / Object.create(null) , and validating input shape. {"__proto__": {"isAdmin":true}} deep merge <rect class='d-box-accent'

317 views

Understand the problem

Polluting Object.prototype via proto in merges.

nodejssecurityprototype-pollutionvalidation

Attempt it yourself

Sketch your approach before reading the solution — that's what interviews test.

Stuck? AI Nudge Available

Get a conceptual hint to guide your logic without spoiling the final implementation.

Study the solution

The solution is waiting

Give it an honest attempt first — then compare your thinking with the full walkthrough.

Read the code

Vulnerable merge vs guarded merge

// ❌ vulnerable: copies __proto__ into the prototype chain
function merge(t, s) { for (const k in s) t[k] = (typeof s[k]==='object') ? merge(t[k]??{}, s[k]) : s[k]; }

// ✅ guard dangerous keys
const BAD = new Set(['__proto__', 'constructor', 'prototype']);
function safeMerge(t, s) {
  for (const k of Object.keys(s)) {
    if (BAD.has(k)) continue;
    t[k] = (s[k] && typeof s[k] === 'object') ? safeMerge(t[k] ?? {}, s[k]) : s[k];
  }
  return t;
}

Join the discussion

Discussion (0)

No responses yet. Be the first to share what you think.

What is AsyncLocalStorage and what problem does it solve?

What is the role of `libuv` in Node.js?