The __proto__ Key in an API Response Is a Merge Bug Waiting to Happen

Every JSON formatter shows it plainly: a key named __proto__ sitting in the middle of an otherwise normal API response. It looks harmless because nothing crashes. That is exactly the problem — the bug shows up two files later, in the code that copies the object.

I tested this in Node 22 with one payload:

{"__proto__":{"polluted":"yes"},"ok":1}

JSON.parse() itself is safe. The key becomes an ordinary own property:

const obj = JSON.parse(raw);
Object.keys(obj);                // [ '__proto__', 'ok' ]
obj.polluted;                    // undefined
obj.hasOwnProperty('__proto__'); // true

So parsing is not the vulnerability. Copying is.

const merged = Object.assign({}, obj);
merged.polluted;   // 'yes' — inherited from the attacker's object
({}).polluted;     // undefined — the global prototype is still intact

Object.assign performs a [[Set]], and __proto__ is an accessor defined on Object.prototype, so the target's prototype is replaced. One object is compromised. A recursive merge is worse:

function merge(target, source) {
  for (const k in source) {
    if (source[k] && typeof source[k] === 'object') {
      target[k] = target[k] || {};
      merge(target[k], source[k]);
    } else target[k] = source[k];
  }
  return target;
}

merge({}, obj);
({}).polluted;   // 'yes' — every object in the process now inherits it

That is prototype pollution, the class behind CVE-2018-3721 and CVE-2019-10744 in lodash's merge (blocked by default since 4.17.11). In a Node service it escalates quietly: a polluted Object.prototype can inject options into child_process calls, template engines, or HTTP client defaults — RCE without a single line of attacker code running at parse time.

Object spread is the safe path, because it uses CreateDataProperty instead of [[Set]]:

const copy = {...obj};
copy.polluted;     // undefined
Object.keys(copy); // [ '__proto__', 'ok' ]

structuredClone() keeps it as an own data property too. So "just use spread" is right for shallow copies and completely useless for a deep merge of nested defaults — which is what most config and webhook handlers actually do.

Fix it once, at the boundary, instead of in every merge helper:

const safe = JSON.parse(raw, (k, v) => k === '__proto__' ? undefined : v);

Or merge into Object.create(null) targets, or use a merge library that explicitly rejects __proto__, constructor, and prototype.

Practical detection: format the payload and look at the keys. I use CodeToolbox's JSON formatter for this — the tree view lists __proto__ like any other key, which is the whole point: JSON itself has no idea the name is special. It runs entirely in the browser, so you can paste a production response without shipping it to a third party.

Check your merge helper before the next webhook payload does it for you.