hunting-server-side-prototype-pollution

name	hunting-server-side-prototype-pollution
description	Hunt server-side prototype pollution in JavaScript and TypeScript backends where untrusted input sets a __proto__, constructor, or prototype key through a recursive merge, a deep clone, a path-based set, or a query or body parser, polluting Object.prototype so a later property read returns an attacker value. Covers the pollution primitive (the write that reaches the prototype) and the gadget (a downstream read of an unset property that changes control flow, a command, a template, or a query). Use when a Node service merges or path-assigns untrusted structured input into objects and later reads properties that may be absent. The untrusted key reaching the prototype is the source, the polluting merge or set is the sink, and the gadget read that turns pollution into impact is the bug.
license	MIT

Hunting server-side prototype pollution: when one request changes every object

In JavaScript, every plain object inherits from Object.prototype, so writing to that shared prototype changes the default value of a property on every object in the process. Server-side prototype pollution happens when untrusted input carries a __proto__, constructor, or prototype key into a recursive merge, a deep clone, or a path-based set that follows the key down to the prototype. The write by itself is a primitive; the impact comes later, when some other code reads a property that was never set and now returns the attacker's injected default. That gadget read can flip an authorization flag, inject an argument into a spawned command, or change a template or query. You find it by locating the pollution primitives and then the gadget reads they enable.

When to use

• A Node.js or server-side TypeScript service merges, clones, or path-assigns untrusted structured input.