How to fix Prototype Pollution

What an attacker can do

The concrete impact of leaving Prototype Pollution unpatched.

How to fix Prototype Pollution

5 ordered steps. Apply them in order — each builds on the previous.

1. 1

   Use Object.create(null) for objects holding user data

   Objects without a prototype can't be polluted because they have no prototype to pollute.

   Use for any object that gets nested merge/extend with user input — config objects, options bags, request state.

   javascriptStep 1

   // ❌ Default object has Object.prototype
   const config = {};
   deepMerge(config, userInput);  // pollution sets Object.prototype.X
   
   // ✅ Object.create(null) has no prototype
   const config = Object.create(null);
   deepMerge(config, userInput);  // sets properties on config only
   
   // Note: Object.create(null) doesn't have toString, hasOwnProperty etc.
   // Use Object.prototype.hasOwnProperty.call(obj, key) when checking keys

2. 2

   Use Map / Set instead of plain objects when keys come from input

   Map and Set are immune to prototype pollution because they don't use the prototype chain for storage.

   If you're using an object as a hashmap (`obj[key] = value`), use Map. Map.set is safe; obj[key] is not when key is user-controlled.

   javascriptStep 2

   // ❌ Object as hashmap with user-controlled keys
   const cache = {};
   for (const item of userItems) {
     cache[item.id] = item;  // if item.id === '__proto__', pollution
   }
   
   // ✅ Use Map
   const cache = new Map();
   for (const item of userItems) {
     cache.set(item.id, item);  // safe — Map keys can be anything
   }

3. 3

   Block __proto__ and constructor at the deserialization boundary

   Reject any input containing `__proto__`, `constructor`, or `prototype` keys. Belt-and-suspenders defense.

   Express middleware can do this globally. Per-request validation with a schema library (Zod, Joi) also catches it.

   javascriptStep 3

   // Express middleware — sanitize __proto__ recursively
   function sanitizePollution(obj, depth = 0) {
     if (depth > 20) return;  // recursion limit
     if (obj === null || typeof obj !== "object") return;
     for (const key of Object.keys(obj)) {
       if (key === "__proto__" || key === "constructor" || key === "prototype") {
         delete obj[key];
       } else {
         sanitizePollution(obj[key], depth + 1);
       }
     }
   }
   
   app.use((req, res, next) => {
     sanitizePollution(req.body);
     sanitizePollution(req.query);
     sanitizePollution(req.params);
     next();
   });

4. 4

   Upgrade vulnerable dependencies (lodash, query-string, etc.)

   Many of the historical pollution vulns are in popular packages. Run AuditCore's Trivy integration to find them; upgrade to patched versions.

   lodash <4.17.21 (CVE-2021-23337), set-value <4.0.1, mixin-deep <2.0.1, dot-prop <5.1.1 — all vulnerable. Newer versions block __proto__ properly.

   jsonStep 4

   {
     "dependencies": {
       "lodash": "^4.17.21",     // CVE-2021-23337 fixed
       "set-value": "^4.0.1",
       "mixin-deep": "^2.0.1",
       "dot-prop": "^5.1.1"
     }
   }
   
   // Run `npm audit` regularly; AuditCore's Trivy integration checks these on every scan

5. 5

   Object.freeze(Object.prototype) on app startup

   Nuclear option: freeze Object.prototype so it cannot be mutated. Runtime cost is negligible; some libraries break (rare).

   Test thoroughly — third-party code that legitimately polyfills `Object.prototype.X` will fail. Most modern code doesn't do that.

   javascriptStep 5

   // In your app entry point, before requiring third-party code
   Object.freeze(Object.prototype);
   Object.freeze(Array.prototype);
   Object.freeze(Function.prototype);
   
   // Now even successful pollution silently fails:
   ({}).__proto__.isAdmin = true;
   console.log({}.isAdmin);  // undefined (silently swallowed in non-strict mode)
   // In strict mode, throws TypeError