Cybersecurity glossary
What is Server-Side Prototype Pollution?
Learn what server-side prototype pollution is, how unsafe merge and clone in Node.js pollute Object.prototype, how gadgets reach child_process and RCE, and how to prevent it in APIs and backends.
Definition
Server-Side Prototype Pollution is a Node.js (and similar JS runtime) vulnerability in which untrusted JSON or objects are deep-merged or cloned unsafely, allowing attackers to modify Object.prototype and influence server logic, configuration, or dangerous APIs—sometimes escalating to remote code execution.
Why server-side prototype pollution matters
On the server, polluted prototypes do not just break a page—they can rewrite how Node.js interprets configuration and options for powerful APIs. Server-Side Prototype Pollution often hides in “harmless” deep merge or clone helpers that accept request JSON, then later code reads inherited fields when spawning processes, rendering templates, or building database options.
Because one polluted property is inherited globally in the process, a single merge bug can affect many unrelated request handlers until the runtime restarts.
How server-side prototype pollution works
Accept nested untrusted JSON
API bodies, webhooks, or config uploads include __proto__ or constructor.prototype paths.
Unsafe merge or clone on the server
Recursive assign, defaultsDeep, or custom extend copies dangerous keys onto Object.prototype.
Server logic inherits attacker fields
Options objects and plain {} lookups suddenly contain shell, env, or path-like properties.
Gadget reaches dangerous Node APIs
child_process, template engines, or dynamic require paths honor polluted options—possible RCE.
Common Node.js risk patterns
Deep merge of request bodies
Merging req.body into defaults without stripping prototype pollution keys.
Recursive clone utilities
Clone/extend helpers that follow constructor.prototype during copying.
child_process / shell gadgets
Polluted options alter command execution behavior when spawning processes.
Config and template sinks
Inherited paths or engines change rendering, file reads, or module resolution.
Prevention that works
| Control | Notes |
|---|---|
| Key denylist on recursion | Reject __proto__, constructor, and prototype at every merge/clone level |
| Schema-first parsing | Allowlist expected fields with a validator before any deep assignment |
| Null-prototype options | Build server option bags with Object.create(null) where feasible |
| Safe merge implementations | Use maintained utilities designed to skip prototype paths; avoid DIY deep assign |
| Isolate dangerous sinks | Never pass untrusted objects into child_process, vm, or dynamic import options |
| Process-level regression tests | After each request fixture, assert Object.prototype has no attacker properties |
- Inventory deep merge, extend, defaultsDeep, and recursive clone usage on untrusted input.
- Filter __proto__, constructor, and prototype keys recursively—not only at the top level.
- Validate request JSON with schemas before merging into configuration or options objects.
- Avoid passing user-influenced objects into child_process, template, or module-loader options.
- Prefer Map or null-prototype objects for server-side dictionaries and caches.
- Add automated tests that POST pollution payloads and verify prototypes stay clean.
- Patch merge/clone dependencies and re-check application wrappers that reimplement them.
- Treat confirmed server-side prototype pollution as high severity until gadgets are ruled out.
The practical takeaway
Server-Side Prototype Pollution turns unsafe Node.js merges into global inheritance bugs that can reach RCE gadgets such as child_process. Deny prototype paths, validate before merging, and never feed untrusted objects into powerful server APIs.
Related security terms
Prototype Pollution
Overview of __proto__ and constructor.prototype pollution across JavaScript.
Client-Side Prototype Pollution
Browser variant that typically escalates to DOM XSS rather than Node RCE.
Code Injection
Related impact class when polluted values reach eval-like or dynamic code sinks.
NoSQL Injection
Another JSON-structure abuse against backends—different interpreter, similar input trust issues.
Frequently asked questions
What is server-side prototype pollution?
Untrusted input is recursively merged into objects on the server. Special keys pollute Object.prototype so later Node.js code inherits attacker-controlled properties and may change security-sensitive behavior.
How does it differ from the client-side variant?
The inheritance mechanism is the same, but sinks differ. Client-side cases often lead to DOM XSS; server-side cases target Node APIs, config objects, template paths, and process execution gadgets.
Where do unsafe merges usually appear?
Body parsers combined with lodash-style defaultsDeep/merge, recursive config loaders, object cloning helpers, and 'extend options' patterns that accept user JSON into server options objects.
How can this become remote code execution?
Polluted properties can alter options for child_process, template engines, module loading, or other dangerous sinks (gadgets). When those APIs honor the inherited fields, attackers may execute OS commands or load attacker code.
Are popular libraries still affected?
Many historical CVEs involved merge/clone utilities. Even patched libraries can be misused if application code reimplements recursive assignment without key filtering.
How do you prevent server-side prototype pollution?
Deny dangerous keys, validate schemas before merging, use null-prototype objects, prefer safe merge implementations, avoid passing untrusted objects into options bags for powerful APIs, and run regression pollution tests.
Is blocking __proto__ enough?
No. Attackers also use constructor.prototype and other assignment paths. Filter recursively and prefer designs that never walk untrusted key trees onto prototypes.
References
Explore authoritative guidance and frameworks related to server-side prototype pollution.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.