Prototype pollution

Summary

Merging untrusted JSON onto {} can set __proto__ / constructor.prototype — affects all objects. Use Object.create(null) maps, structured clone, schema validation (Zod), libraries patched against pollution. Supply chain in lodash-era merge utilities — validate deep merge sources.

Code example

function safeMerge(target, source) {
  for (const key of Object.keys(source)) {
    if (key === '__proto__' || key === 'constructor') continue;
    target[key] = source[key];
  }
  return target;
}

const data = safeMerge(Object.create(null), untrustedJson);

Key points

• Merging untrusted JSON onto {} can set __proto__ / constructor.prototype — affects all objects.
• Use Object.create(null) maps, structured clone, schema validation (Zod), libraries patched against pollution.
• Supply chain in lodash-era merge utilities — validate deep merge sources.

Further reading

• Object.prototype pollution
• Structured clone

Related concepts

• DOM clobbering
• Same-origin policy nuances