Skip to content
SelfSec
Join the launch listLaunch list
SelfSec
Vulnerability field guide

Prototype Pollution

A single __proto__ key in a request can change the defaults of every object in a Node.js process or a browser page. Here is how unsafe merges cause prototype pollution, which gadgets turn it into real impact, and how to close it.

1 article 8 min total Overview to advanced techniques

Start with the overview

Prototype Pollution8 min read

Prototype Pollution: How One JSON Key Changes Every Object in Your App

A single __proto__ key in a request can change the defaults of every object in a Node.js process or a browser page. Here is how unsafe merges cause prototype pollution, which gadgets turn it into real impact, and how to close it.

Read the overview