---
title: "No, We Can't Harden Node.js Against Prototype Pollution"
url: https://daily.dev/posts/no-we-can-t-harden-node-js-against-prototype-pollution-agutzkidu
source_url: https://adventures.nodeland.dev/archive/no-we-cant-harden-nodejs-against-prototype
type: article
source: "Adventures in Nodeland"
published: 2026-07-19T16:24:07.012Z
updated: 2026-07-19T18:21:13.060Z
tags: ["javascript", "nodejs", "appsec"]
reading_time: 7
upvotes: 99
comments: 2
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# No, We Can't Harden Node.js Against Prototype Pollution

**[Adventures in Nodeland](https://daily.dev/sources/nodeland)** · 7 min read · 99 upvotes · 2 comments

## Summary

Matteo Collina, Node.js TSC member, argues that hardening Node.js core against prototype pollution gadgets is structurally impossible. Once an attacker can write to Object.prototype, the game is already over — any gadget found in core or a library is just one of infinitely many exit points. Primordials protect Node's own integrity but don't secure application objects. The real fix is at the input boundary: use secure-json-parse to reject __proto__ and constructor.prototype keys before they enter the process, prefer Maps for untrusted keys, and use null-prototype objects for attacker-controlled data. Node.js does not accept prototype pollution in core as a vulnerability in its bug bounty program for this reason.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://adventures.nodeland.dev/archive/no-we-cant-harden-nodejs-against-prototype>

## Community discussion

Top comments from developers on daily.dev.

**@pdfopsdev** · 0 upvotes

> ran into this exact class of bug with qs a while back, query-string parsing has its own **proto** vector totally separate from JSON.parse. secure-json-parse only locks one door, you need the same check wherever untrusted keys turn into object keys - query strings, form bodies, yaml configs, all of it.

## Similar posts on daily.dev

- [Property-Based Testing Caught a Security Bug I Never Would Have Found](https://daily.dev/posts/property-based-testing-caught-a-security-bug-i-never-would-have-found-498pmhojr) · Kiro · 1 upvotes · 0 comments

---

Tags: [#javascript](https://daily.dev/tags/javascript), [#nodejs](https://daily.dev/tags/nodejs), [#appsec](https://daily.dev/tags/appsec)

[View this post on daily.dev](https://daily.dev/posts/no-we-can-t-harden-node-js-against-prototype-pollution-agutzkidu)