Application Security Glossary

Prototype Pollution

Q: How does prototype pollution work?

It typically occurs when untrusted data with keys like __proto__, constructor, or prototype is passed to a recursive merge, clone, or object-mapping function. Setting a property via such a key writes to Object.prototype, and every object then inherits the injected value.

Q: How do you prevent prototype pollution?

Validate and allowlist incoming keys, block __proto__, constructor, and prototype in dynamic assignments, use Object.create(null) or Map for untrusted key-value data, freeze Object.prototype, and keep merge, clone, and query-parsing dependencies up to date.

Prototype pollution is a JavaScript vulnerability where an attacker injects properties into a base object's prototype (such as via __proto__), causing those properties to appear on all objects at runtime and leading to denial of service, property tampering, or in some cases remote code execution.

Prototype pollution is specific to JavaScript's prototype-based inheritance. Every object inherits from a shared prototype (Object.prototype), so if untrusted input can set a property on that prototype — typically through keys like __proto__, constructor, or prototype during a recursive merge, clone, or JSON-to-object mapping — the injected property is inherited by every object in the application. Attackers exploit this by sending crafted payloads such as {"__proto__": {"isAdmin": true}} to endpoints or config parsers that deep-merge user data.

The impact depends on how the polluted properties are later used. At minimum it can cause denial of service or unexpected behavior by overriding defaults; more seriously it can bypass security checks (e.g. forcing an isAdmin or access flag to be truthy), enable cross-site scripting by tainting template or sanitizer logic, or escalate to remote code execution in gadget chains such as certain server-side rendering or command-spawning paths. It is cataloged as CWE-1321.

Developers mitigate prototype pollution by validating and allowlisting input keys, rejecting __proto__/constructor/prototype in dynamic property assignment, using Object.create(null) or Map for untrusted key-value data, freezing prototypes with Object.freeze(Object.prototype), and keeping deep-merge, clone, and query-parsing libraries patched, since many historical CVEs in the JavaScript ecosystem stem from this class.

Frequently asked questions

What is prototype pollution?

Prototype pollution is a JavaScript vulnerability where attacker-controlled input adds or overrides properties on a base object's prototype, so those properties are inherited by all objects at runtime — potentially causing denial of service, security-check bypass, XSS, or remote code execution.

How does prototype pollution work?

It typically occurs when untrusted data with keys like proto, constructor, or prototype is passed to a recursive merge, clone, or object-mapping function. Setting a property via such a key writes to Object.prototype, and every object then inherits the injected value.

How do you prevent prototype pollution?

Validate and allowlist incoming keys, block proto, constructor, and prototype in dynamic assignments, use Object.create(null) or Map for untrusted key-value data, freeze Object.prototype, and keep merge, clone, and query-parsing dependencies up to date.

Scan your repo free All terms

Prototype Pollution

Frequently asked questions

Related terms