securityAnswer last reviewed July 2026

Can you explain prototype pollution to me, how the attack actually works in Node, and what you'd do to prevent it?

Strong answers show the attacker-controlled key actually writing onto Object.prototype, and can name the specific defenses that stop it.

What an AI-prepared candidate might say

Prototype pollution is basically when an attacker manages to modify Object.prototype, the base object every JavaScript object inherits from. It usually comes in through user input with special keys like __proto__ or constructor.prototype. So if your code takes untrusted data and merges it into an object, like a deep merge or an unsafe Object.assign, the attacker can set properties on the prototype, and then those properties affect every object in the app. That can mean denial of service, changed application logic, or in some cases even code execution. The defense is to validate input and avoid unsafe merges of untrusted data. You can use objects with no prototype, freeze Object.prototype, block the dangerous keys like __proto__, or use a schema validator that only accepts expected fields. Keeping dependencies updated helps too, libraries have shipped these bugs before. The core idea is keeping user-controlled keys off the prototype chain.

Senior
Locked

Follows a __proto__ key from the request body all the way onto Object.prototype, why the merge is the step that breaks, and how the pollution surfaces across the whole process.

Unlock the depth
Staff
Locked

The layered defenses that actually hold up, null-prototype objects, key blocking, schema validation, the runtime flag, and how you track down the vulnerable merge in your own code.

Unlock the depth
Follow-up chain
Can you explain prototype pollution to me, how the attack actually works in Node, and what you'd do to prevent it? | NodeBook