Node.js prototype pollution: request body deep merge
Rule ID: vetkit.js.prototype-pollution.request-merge
A parsed request body or query object is deep-merged into another object, or a request value is used as the property path of a set helper. A payload with a __proto__ or constructor.prototype key then modifies Object.prototype for the whole process (prototype pollution): lodash before 4.17.21, the standalone lodash.merge / lodash.set packages, deepmerge, merge-deep, mixin-deep, extend and dot-prop releases with known advisories do not block such keys.
Last updated:
Suite: Security
javascript, typescript
A parsed request body or query object is deep-merged into another object, or a request value is used as the property path of a set helper. A payload with a __proto__ or constructor.prototype key then modifies Object.prototype for the whole process (prototype pollution): lodash before 4.17.21, the standalone lodash.merge / lodash.set packages, deepmerge, merge-deep, mixin-deep, extend and dot-prop releases with known advisories do not block such keys.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Validate the body with a schema that strips unknown keys (zod .parse, Joi) or copy only the expected fields before merging, merge into an object created with Object.create(null), and never build a property path from request input.
References
Source: packages/engine/rules/sast/javascript.yml.
Related checks
- JavaScript prototype pollution in a recursive merge
- JavaScript prototype pollution via obj[key][prop] request key
- NextAuth allowDangerousEmailAccountLinking enabled
- NextAuth Auth.js debug: true logs tokens in production
- NextAuth Auth.js hardcoded secret in source code
- JavaScript eval() with a dynamic argument: code injection
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.