Block prototype pollution

How to do it

Copy only named fields from input. Use Map or Object.create(null) for lookups keyed by user input. Use merge libraries that skip __proto__, constructor and prototype, and keep them updated. Validate request bodies against a schema that rejects unknown keys.

Example

// Bad: a deep merge copies __proto__ onto Object.prototype
deepMerge(settings, req.body);
// Good: only named fields, from a schema that rejects unknown keys
const { theme, language } = SettingsSchema.parse(req.body);

How to check

On staging, send {"__proto__": {"isAdmin": true}} and {"constructor": {"prototype": {"isAdmin": true}}} in a JSON body. Then call an admin route as a normal test user. It still returns 403.