High ThreatWeb & Injection DefenseCWE-1321
Prototype Pollution Defense in JavaScript/Node.js
Prevent Prototype Pollution in JavaScript and Node.js using Object.freeze, Map primitives, and safe recursive merging.
Vulnerability Overview
Modifying Object.prototype alters behavior of all objects.
Attackers inject __proto__ keys into JSON payloads.
Vulnerable Code
Object.assign({}, JSON.parse(user_input));Vulnerable to prototype merging.
Remediated Code
const clean = Object.create(null);Creates objects without prototypes.
Hardening Rules
- 1Use Object.create(null)
- 2Freeze prototypes
- 3Use Maps instead of Objects for data
Frequently Asked Questions
How do Maps help?
Maps do not suffer from inherited properties like __proto__.