Prototype Pollution in 2025: From Toy to Tenant-Takeover

JavaScript objects inherit from Object.prototype. A deep-merge or recursive-assign function that does not check property names will let an attacker write to __proto__.x, which makes x appear on every object in the runtime. Libraries with vulnerable merges include older versions of lodash, deepmerge, and any home-rolled deep copy.

// Vulnerable merge
merge({}, JSON.parse(req.body));
// payload: {"__proto__": {"isAdmin": true}}
// effect: every object now has isAdmin=true

Once an attacker can set arbitrary keys on the prototype, the next step is finding a sink that reads from a polluted key. Common sinks: shell argument to child_process.spawn, Express options for view rendering, Mongoose schema options. Public research has demonstrated full RCE chains in real frameworks.

In the browser, prototype pollution combined with a template engine or sanitizer that checks options against the prototype becomes DOM XSS. The path is usually: pollute __proto__.src, trigger a code path that reads options.src, end with arbitrary script execution.

Use Object.create(null) for any object built from user input. Set Object.freeze(Object.prototype) at process start (be aware of compatibility). Update lodash and similar merge libraries to versions that explicitly reject __proto__, constructor, prototype keys. Static analysis flags most cases; manual review catches the rest. Our Node.js pitfalls piece has the framework-specific list.