Software Securityhome
Fix a findingSearch
Glossary

Prototype pollution

In JavaScript, untrusted keys such as __proto__ or constructor.prototype modify a shared object prototype and change the behavior of every object that inherits from it (CWE-1321).

Defined in
MITRE CWE-1321

Covered in

Guide

Keep untrusted object keys out of prototype and authority paths

Trace an actual nested-merge mutation, replace it with a narrow schema, and make authorization independent of inherited properties.

Practice: Local project: Stop prototype pollution at merge and authorization boundaries

Find your next answer

Type to search. Search runs in your browser.

Searches run in your browser, but the host can infer them from the index files they load. The address shows your search so you can bookmark or share it.