No, We Can't Harden Node.js Against Prototype Pollution

Matteo Collina, Node.js TSC member, argues that hardening Node.js core against prototype pollution gadgets is structurally impossible. Once an attacker can write to Object.prototype, the game is already over — any gadget found in core or a library is just one of infinitely many exit points. Primordials protect Node's own integrity but don't secure application objects. The real fix is at the input boundary: use secure-json-parse to reject __proto__ and constructor.prototype keys before they enter the process, prefer Maps for untrusted keys, and use null-prototype objects for attacker-controlled data. Node.js does not accept prototype pollution in core as a vulnerability in its bug bounty program for this reason.