Module 17 · Prototype Pollution

Last updated: May 1, 2026

Prototype pollution is a JavaScript-specific vulnerability where attacker-controlled input modifies the prototype of base objects (Object, Array). Once polluted, every object inherits attacker-controlled properties — leading to RCE in some Node.js apps, XSS in some browsers, authentication bypass in some apps. This module covers the mechanism, detection, and defenses.

JavaScript prototype basics

Every object in JavaScript has a prototype. Property lookups walk up the chain: object → its prototype → its prototype’s prototype → … → Object.prototype → null.

const a = {};
console.log(a.toString);     // function (inherited from Object.prototype)
Object.prototype.foo = "polluted";
console.log({}.foo);         // "polluted" — every new object has it

If attacker can write to Object.prototype, every object in the application gets new properties, retroactively.