Definition

MITRE’s description of CWE-1321: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Common consequences MITRE lists

  • Confidentiality, Integrity, Availability: Read Application Data; Modify Application Data
  • Availability: DoS: Crash, Exit, or Restart

Why it matters

A polluted prototype changes behavior across the application: it can bypass checks, enable XSS in browsers, or lead to code execution in Node.js through gadgets.

How to prevent it

  • Reject __proto__, constructor and prototype keys when merging objects or setting paths from input.
  • Use Map, or objects created with Object.create(null), for dictionaries keyed by untrusted strings.
  • Validate input against a schema before merging it, and consider freezing Object.prototype.

Guides on this site

Main subject · Guide

Keep untrusted object keys out of prototype and authority paths

Trace an actual nested-merge mutation, replace it with a narrow schema, and make authorization independent of inherited properties.

Practice

References

  1. CWE-1321 in the MITRE CWE list (version 4.20)
  2. OWASP Prototype Pollution Prevention Cheat Sheet

List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.

CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.