PackageFix / Glossary / Prototype Pollution

Prototype Pollution

JavaScript · npm
Definition

Prototype pollution is a JavaScript vulnerability where an attacker can modify Object.prototype — the base blueprint that every JavaScript object inherits from. Once polluted, the malicious properties show up in every object in the application, which can lead to unexpected behavior, authentication bypasses, or remote code execution.

What actually happens

In JavaScript, every object inherits from Object.prototype. Think of it as a base template — when you create any object, it automatically gets properties from this template. Prototype pollution lets an attacker write to that template through crafted input.

The attack usually comes through a function that merges or deep-copies objects — lodash's merge(), qs's query string parser, and similar utilities. If the function doesn't filter out keys like __proto__ or constructor.prototype, an attacker can slip in a payload that modifies the global template.

What a payload looks like

Attack payload in a query string
?__proto__[isAdmin]=true

If your application parses this with a vulnerable version of qs or lodash, and later checks user.isAdmin somewhere, every user might suddenly be an admin — including unauthenticated requests.

Which packages have had prototype pollution CVEs

It's a recurring problem in JavaScript utility libraries. Packages that do deep object manipulation are the most common source:

How to protect against it

Prevention

Keep utility libraries up to date — most prototype pollution CVEs are fixed within weeks of discovery. Use Object.freeze(Object.prototype) in security-sensitive contexts. Validate and sanitize any object keys that come from user input before merging.

Check your dependencies for CVEs, CISA KEV entries, and supply chain risks.

Open PackageFix →

Free · No signup · No CLI · Runs in your browser

Common questions

Is prototype pollution the same as prototype hijacking?
They describe the same class of vulnerability. Prototype pollution is the more common term in CVE descriptions and security tooling. Both refer to modifying Object.prototype via crafted input.
Can prototype pollution lead to remote code execution?
Yes — in some cases. If the polluted prototype property ends up in a code path that calls eval(), executes shell commands, or deserializes data, prototype pollution can escalate to RCE. Most commonly it leads to authentication bypass or DoS.
Does TypeScript protect against prototype pollution?
No. TypeScript is a compile-time tool. Prototype pollution happens at runtime — TypeScript types are erased by then. You still need to update affected packages and sanitize input.
How does PackageFix detect prototype pollution CVEs?
PackageFix queries the OSV database for every package in your manifest and flags any version with a known prototype pollution CVE. Affected packages get a HIGH or CRITICAL badge with the specific CVE ID and safe version to upgrade to.

Related guides

Fix Lodash CVE-2020-8203

Prototype pollution fix

Fix qs CVE-2022-24999

Query string pollution fix

Fix minimist CVE-2021-44906

Arg parser pollution fix

Supply Chain Attack

How dependencies get compromised