Preventing Prototype Pollution in JavaScript and Node.js: Deep Merge Hazards and Object.freeze()

The Mechanics of Prototype Pollution

In JavaScript, objects inherit properties from Object.prototype. If an unvalidated recursive merge function accepts user-controlled JSON keys containing __proto__ or constructor.prototype, an attacker can inject properties into every object across the entire Node.js runtime, leading to authentication bypass or Remote Code Execution.

Defensive Coding Patterns

// 1. Use dictionary objects with no prototype
const safeDict = Object.create(null);

// 2. Validate keys before recursive merging
const forbiddenKeys = ['__proto__', 'constructor', 'prototype'];
if (forbiddenKeys.includes(key)) {
    throw new Error('Illegal property key detected');
}

// 3. Freeze core prototypes at application startup
Object.freeze(Object.prototype);