JavaScript prototype pollution in a recursive merge
Rule ID: vetkit.js.prototype-pollution.recursive-merge
A hand-written recursive merge copies every key of the source object into the target, recursing into nested objects, without rejecting __proto__, constructor or prototype. Called on parsed JSON from a request, a {"__proto__": {"isAdmin": true}} payload modifies Object.prototype for the whole process (prototype pollution).
Last updated:
Suite: Security
javascript, typescript
A hand-written recursive merge copies every key of the source object into the target, recursing into nested objects, without rejecting __proto__, constructor or prototype. Called on parsed JSON from a request, a {"__proto__": {"isAdmin": true}} payload modifies Object.prototype for the whole process (prototype pollution).
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Skip the keys __proto__, constructor and prototype (or copy only own properties of a known allow-list), create the target with Object.create(null), or use a maintained library such as lodash 4.17.21+ / deepmerge 4.3+ that blocks these keys.
References
Source: packages/engine/rules/sast/javascript.yml.
Related checks
- JavaScript prototype pollution via obj[key][prop] request key
- Node.js prototype pollution: request body deep merge
- NextAuth allowDangerousEmailAccountLinking enabled
- NextAuth Auth.js debug: true logs tokens in production
- NextAuth Auth.js hardcoded secret in source code
- JavaScript eval() with a dynamic argument: code injection
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.