Lab: Detecting server-side prototype pollution without polluted property reflection
Summary: PortSwigger's lab runs on Node.js and Express and is vulnerable to server-side prototype pollution because it unsafely merges user-controllable input into a server-side JavaScript object. The detection technique injects a __proto__ property with a status value between 400 and 599, then breaks the JSON syntax to trigger an error whose status and statusCode fields match the injected value, confirming Object.prototype was polluted.
What you should know: The confirmation only appears when the server errors, so a polluted prototype can sit undetected in normal responses - and the lab itself warns that testing can break functionality or bring the server down, an option you won't have on a real site.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026