Can you explain prototype pollution to me, how the attack actually works in Node, and what you'd do to prevent it?
Strong answers show the attacker-controlled key actually writing onto Object.prototype, and can name the specific defenses that stop it.
Prototype pollution is basically when an attacker manages to modify Object.prototype, the base object every JavaScript object inherits from. It usually comes in through user input with special keys like __proto__ or constructor.prototype. So if your code takes untrusted data and merges it into an object, like a deep merge or an unsafe Object.assign, the attacker can set properties on the prototype, and then those properties affect every object in the app. That can mean denial of service, changed application logic, or in some cases even code execution. The defense is to validate input and avoid unsafe merges of untrusted data. You can use objects with no prototype, freeze Object.prototype, block the dangerous keys like __proto__, or use a schema validator that only accepts expected fields. Keeping dependencies updated helps too, libraries have shipped these bugs before. The core idea is keeping user-controlled keys off the prototype chain.