What Is a Prototype Pollution Attack? A Plain-English Guide for UK Businesses

The Short Version

Prototype pollution is a class of vulnerability found in JavaScript applications — both server-side (Node.js) and client-side (browser). It allows an attacker to inject properties into the base `Object.prototype`, which every JavaScript object inherits from. Because those properties are inherited by all objects in the application, the injected values can change how the application behaves in ways the developer never intended.

The result ranges from property overrides that bypass logic checks to remote code execution on the server, depending on how the polluted properties are subsequently used.

JavaScript Prototypes: The Thirty-Second Background

JavaScript uses prototypal inheritance. Every object has a prototype — an object it inherits properties and methods from. At the top of the chain is `Object.prototype`, the base from which all plain objects ultimately inherit.

When you access a property on an object and the object does not have that property directly, JavaScript walks up the prototype chain looking for it. If it finds the property on `Object.prototype`, that value is returned — even if you never set it on the object you were looking at.

Prototype pollution exploits this by injecting properties onto `Object.prototype` itself, making them appear on every object in the application.

A Concrete Example

Imagine a Node.js application that merges user-supplied JSON into a configuration object:

```javascript function merge(target, source) { for (let key in source) { if (typeof source[key] === 'object') { target[key] = merge(target[key] || {}, source[key]); } else { target[key] = source[key]; } } return target; } ```

This looks reasonable. But consider what happens when an attacker sends:

```json {"__proto__": {"isAdmin": true}} ```

The merge function iterates over the source object's keys. When it encounters `__proto__`, it sets `target["__proto__"]["isAdmin"] = true`. In JavaScript, `__proto__` is a special accessor that refers to the object's prototype. Writing to it writes to `Object.prototype`.

Now every plain object in the application has `isAdmin: true` as an inherited property. If the application checks `user.isAdmin` without verifying the property exists directly on the user object, that check returns true for every user — including unauthenticated ones.

Why This Is More Serious Than It Sounds

The impact depends on what the application does with properties it finds on objects. Common consequences include:

**Authentication bypass** — Logic that checks `if (user.role === 'admin')` or `if (options.debug)` can be subverted if those properties are polluted onto the prototype.

**Denial of service** — Polluting `Object.prototype.toString` or other fundamental methods can cause errors throughout the application, crashing processes or producing unexpected output.

**Remote code execution** — In server-side JavaScript environments (Node.js), some execution paths use object properties to construct shell commands, file paths, or dynamic require calls. If polluted properties feed into those paths, an attacker can achieve code execution.

**Template injection** — Templating engines that look up properties on objects to render templates can be manipulated to execute arbitrary expressions if the property they are looking for has been polluted.

Where Does Prototype Pollution Typically Occur

The vulnerability appears when user-supplied data is processed by functions that recursively merge, clone, or extend objects without excluding special keys like `__proto__`, `constructor`, and `prototype`.

Libraries that are commonly affected include deep merge utilities, query string parsers, and object serialisation/deserialisation code. Several popular npm packages have disclosed prototype pollution vulnerabilities in the past, including lodash (CVE-2019-10744), jQuery (CVE-2019-11358), and others. Patched versions have been available for years, but applications running outdated dependencies remain vulnerable.

Client-side prototype pollution occurs in the browser and can be used to introduce XSS gadgets — sequences of code that, when triggered by a polluted property, execute attacker-controlled JavaScript.

How Attackers Identify and Exploit It

Automated tools that fuzz application endpoints with payloads like `{"__proto__": {"x": 1}}` and then check whether subsequent objects have the `x` property can quickly identify vulnerable merge paths.

For client-side pollution, attackers supply payloads via URL query parameters, hash fragments, or JSON request bodies, then look for DOM sinks that consume the polluted properties to trigger JavaScript execution.

Security scanners that include prototype pollution payloads in their test suites will flag these vulnerabilities in web applications and APIs.

How to Fix Prototype Pollution

Use safe merge functions

Replace deep merge implementations with libraries that explicitly guard against prototype pollution. Modern versions of lodash (`_.merge`) and similar utilities have been patched to sanitise keys. If you write your own merge function, block assignment to `__proto__`, `constructor`, and `prototype` explicitly.

Use Object.create(null) for untrusted data

Objects created with `Object.create(null)` have no prototype and therefore cannot be used as a vehicle for prototype pollution. For dictionaries and key-value stores that accept user-controlled keys, this is the safest approach.

Freeze Object.prototype

In environments where you control the runtime, `Object.freeze(Object.prototype)` prevents modifications to the base prototype. This is a defence-in-depth measure that catches pollution attempts at runtime.

Keep dependencies updated

Many prototype pollution vulnerabilities exist in third-party libraries rather than application code. Running `npm audit` or using a software composition analysis tool as part of your CI pipeline identifies known vulnerabilities in your dependency tree.

Validate and sanitise input

Before passing user-supplied JSON into any merge or clone operation, validate the structure against an expected schema and strip or reject keys that should never appear, including `__proto__`, `constructor`, and `prototype`.

Detection in Security Testing

Prototype pollution is included in the OWASP testing guide and in automated vulnerability scanners. An Yrzo AI scan checks for prototype pollution-susceptible merge functions in publicly accessible JavaScript bundles and tests API endpoints with prototype pollution payloads.

For client-side pollution, the scanner reviews the JavaScript bundle for known-vulnerable patterns and gadget chains that could lead to DOM-based XSS.

Run a scan at yrzoai.dev — 44 checks, full report, under 20 minutes from £399.