Prototype Pollution: How One JSON Key Changes Every Object in Your App
A single __proto__ key in a request can change the defaults of every object in a Node.js process or a browser page. Here is how unsafe merges cause prototype pollution, which gadgets turn it into real impact, and how to close it.