security-review-owasp-prototype-pollution-prevention

To find prototype pollution vulnerabilities in JavaScript and Node.js, trace untrusted input through object creation, deep merge, clone, and property assignment paths to detect dangerous keys like __proto__ and constructor.prototype. This identifies where shared prototypes can be poisoned.

Prototype pollution is a JavaScript vulnerability where attacker-controlled object paths alter the prototype of shared objects, changing application behavior, authorization, or runtime state. It typically occurs when untrusted input is processed through unsafe deep merge or clone utilities.

Review a Node.js service for prototype pollution risks by tracing parsed JSON or query parameters through object creation and property assignment flows. Validate whether crafted input could inject dangerous keys like __proto__ and poison shared prototypes affecting later requests.

Yes, using null-prototype objects is a runtime hardening control to prevent prototype pollution in JavaScript. This Skill checks for missing hardening controls like null-prototype objects and validates whether runtime mitigations are properly applied across your codebase.

The best way to secure deep merge operations against inherited property abuse is evidence-driven tracing of untrusted data flows and validation of runtime hardening controls. This process detects dangerous keys and generates severity-ranked findings with review gaps.

You need a prototype pollution security review when your codebase consumes untrusted input through object creation, deep merge, query parsing, or clone flows. It is essential to prevent attacker-controlled object paths from altering runtime behavior or authorization state.