Everything I know about prototype pollutions: how to react when confronted to a brand new vuln

The talk follows the history of prototype pollution in the JavaScript ecosystem, starting with a 2018 bug bounty report that affected a dozen npm packages. The speaker, who ran the Node.js ecosystem bounty program at the time, describes how the team first had to decide whether the issue was a real security flaw or only a code quality defect. Before reaching the exploit, the talk explains how JavaScript objects inherit properties through their prototype chain, using a debugger to show where inherited methods come from.

From there, the talk shows how a recursive merge function can be tricked into writing to the global prototype, so every object in a process picks up attacker-chosen properties. It covers a similar path in lodash through the constructor, then two real cases: a denial of service caused by replacing a method with a string, and a remote code execution in Kibana where a polluted environment variable was inherited by a child process. A later issue in a MongoDB-backed API service, which chained the pollution into a deserialization option, is also described.

For defense, the speaker recommends rejecting proto and constructor keys from untrusted input, validating object shapes with schemas, creating prototype-less objects, and disabling proto where possible. The closing reflections are that the team should have involved Node.js core earlier to model the threat, and that static analysis still struggled with this bug class.