Node.js · Senior · Question 27 of 75
What is prototype pollution?
merge({}, JSON.parse('{"__proto__": {"isAdmin": true}}'));
({}).isAdmin; // true- ✓Correct answer: An attack where input sets properties on
Object.prototype(e.g. via__proto__), changing every object in the app - 2Adding too many methods to a class
- 3A memory leak in prototype chains
Explanation
Unsafe deep merges and path setters are the usual cause. Block __proto__, constructor and prototype keys, use Object.create(null) or Map, and validate input with a schema.