prototype-pollution

JavaScript prototype pollution occurs when untrusted keys are merged into objects, mutating shared prototype state via __proto__ or constructor.prototype paths. This allows attacker-controlled parameters to alter global object behavior during query parsing or JSON body handling.

To test for prototype pollution in server-side JavaScript, send a JSON request containing a __proto__ payload to a candidate merge point, then follow with a clean request to verify if global parsing or unrelated response behavior changes.

The best way to detect prototype pollution via object merge utilities is through black-box detection workflows that probe both __proto__ and constructor.prototype paths, validating observable side effects and persistence across subsequent requests.

Prototype pollution can lead to remote code execution by reaching downstream gadget sinks. Exploit path guidance maps post-pollution sinks, such as template or configuration-based RCE patterns, to prioritize real security impact.

Prototype pollution testing works for query string parsing vulnerabilities by checking if web and API stacks consume attacker-controlled parameters during deep assignment or merge operations, mutating shared prototype state globally.