Server-side prototype pollution: Black-box detection without the DoS
Summary: PortSwigger researcher Gareth Heyes published techniques for detecting server-side prototype pollution black-box without causing a denial of service, since polluting a global prototype persists for the lifetime of the Node process and can break the app for every visitor or shut the process down entirely. The methods use harmless requests that produce subtle, predictable response differences, including Express's parameter limit, ignoreQueryPrefix, and allowPrototypes options in the qs library, plus content-type manipulation to render JSON as UTF-7, and were implemented in an open source Burp Suite extension.
What you should know: A single successful prototype pollution probe can persist until the Node process restarts, so a tester who breaks core functionality takes the site down for every user, not just themselves - and the article notes prior prototype pollution bugs in Kibana and the Blitz framework both reached remote code execution.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026