Prototype pollution is a vulnerability that occurs when an attacker manipulates the prototype of an object to introduce malicious properties or methods. This can lead to unintended behaviour or security breaches in the application.

Why is it a Security Risk?

1
Privilege Escalation: As shown above, if an application checks if (user.isAdmin), an attacker can make themselves an admin globally.
2
Denial of Service (DoS): An attacker can overwrite built-in methods like toString or valueOf with a value that isn't a function, causing the entire application to crash the next time that method is called.
3
Remote Code Execution (RCE): If the polluted property is used as a configuration for a system command (like a file path or a template engine setting), the attacker can execute arbitrary code on the server.
4
Bypassing Input Validation: Attackers can inject properties that bypass security filters or sanitizers that rely on checking object properties.

How to prevent it:

1
Use Object.create(null): If you are creating an object to store data (like a map or a cache), create it without a prototype. This makes it immune to pollution.
2
Validate Keys: Always check if the key being processed is proto, constructor, or prototype and block it.
3
Freeze the Prototype: In your main entry file, you can freeze the base prototype to prevent any changes at runtime.
4
Use Map instead of Object: For collections of dynamic keys, use the Map data structure. It does not use the prototype chain for its entries, making it safe from this specific attack.

javascript

Difficulty: 6/10

Topics: prototype chain, object property injection, security vulnerabilities

Scenario Questions

0-2 years experience

1
If you receive a JSON payload that will be merged into a plain object using Object.assign, what could go wrong if the payload contains a proto property?
2
How would you prevent prototype pollution when you need to deep‑merge user‑provided configuration objects?

2-5 years experience

1
We have a Node.js microservice that uses lodash's merge to combine request bodies into a settings object. Suddenly some users can read other users' data. Walk me through how prototype pollution could cause this and how you'd debug it.
2
When adding a new feature that stores user preferences in a shared in‑memory cache, what trade‑offs would you consider to avoid prototype pollution while keeping performance high?

5-8 years experience

1
Design a library that safely merges arbitrary objects from untrusted sources. What patterns would you use to guard against prototype pollution, and how would you test it at scale?
2
Our platform runs third‑party plugins that may extend objects. How would you architect a sandbox or isolation layer to ensure prototype pollution cannot affect the core runtime?

8+ years experience

1
Across multiple services we have a shared internal SDK that many teams import. How would you lead a migration to eliminate prototype‑pollution risks without breaking existing integrations?
2
What long‑term governance processes would you put in place to detect and prevent prototype pollution in a large codebase that includes many open‑source dependencies?

Follow-up Questions

❓Can you show a minimal code snippet that demonstrates the vulnerability?
❓What other JavaScript features could be abused in a similar way?
❓How would you monitor for such attacks in production?