How prototype pollution works
Recursive merge plus a magic key equals global contamination.
JavaScript objects inherit from prototypes, and every object shares Object.prototype. Recursive merge utilities copy each key of the source onto the target — including a key literally named proto, which does not create a property but walks into the prototype itself. Merging {"__proto__": {"polluted": true}} sets polluted on every object in the process.
Impact follows what reads the poisoned property: feature flags that flip, admin checks that pass, templates that render attacker strings. The payload arrives through any deep-parsed input — JSON bodies, query strings expanded to objects, URL fragments — wherever attacker keys reach a merge.
The fix is key hygiene at the merge: skip proto, constructor, and prototype keys, use maps instead of objects for untrusted keys, or freeze Object.prototype in depth. Modern runtimes also offer JSON parsing that preserves own-property semantics — use the merge that cannot walk.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.