Skip to content

Cybersecurity Atlasby Jer Catallo

Cybersecurity Atlas

One reference surface for application, cloud and product security.

API documentation

Find & Respond

AppSec Playbook
Vulnerabilities Atlas

Build & Harden

Hardening Atlas
Security Tooling

Learn the Fundamentals

Security Concepts

Resources

OWASP Top 10
MITRE ATT&CK
NIST Cybersecurity Framework

© 2026 Jer Catallo. Reference material only, always confirm against the official source.

About
API Documentation

Prototype Pollution incident response playbook · Cybersecurity Atlas

Home
Playbook
Prototype Pollution

Prototype Pollution

HighWeb Application SecurityA08:2021 – Software and Data Integrity Failures

Attackers manipulate JavaScript object prototypes through crafted input, affecting all objects that inherit from the polluted prototype and enabling property injection, denial of service, or remote code execution.

Immediate Response

1Identify and patch the vulnerable merge or property assignment code path.
2Restart affected Node.js processes to clear polluted prototypes.
3Review application logs for evidence of exploitation impact.
4Audit all property access patterns that may have been affected.

Short-term Remediation

1Use Object.create(null) for dictionaries that accept untrusted keys.
2Validate and sanitize property paths before deep merge operations.
3Block __proto__, constructor, and prototype properties in user input.
4Use safe merge libraries that explicitly handle prototype pollution vectors.

Long-term Prevention

1Freeze Object.prototype at application startup with Object.freeze().
2Include prototype pollution test cases in security testing pipelines.
3Audit all third-party libraries for known prototype pollution vulnerabilities.
4Adopt TypeScript or linting rules that flag unsafe property access patterns.

Attack vectors

Merging user-controlled JSON into objects without prototype checks
Setting __proto__ or constructor.prototype properties through property paths
Exploiting unsafe deep merge utilities in JavaScript libraries
Polluting Object.prototype via JSON.parse with reviver functions

Indicators of compromise

Unexpected properties appearing on all objects in application logs
Application crashes or infinite loops triggered by polluted prototype methods
Security bypasses where authorization checks rely on polluted default values
Anomalous behavior in conditional logic checking prototype-inherited properties

Tooling

ppmapSemgrepNode.js --frozen-intrinsics flagSnyk

References

cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Cheat_Sheet.html
github.com/HoLyVieR/prototype-pollution-nsec18