Expected Findings
- Deep-merge follows `__proto__` and `constructor` keys without filtering.
- Pollution propagates to other request handlers in the same process.
- Feature flags read from the polluted object trust the attacker values.
Config Merge
Prototype Pollution
A deep-merge endpoint walks `__proto__` keys, so attacker JSON pollutes the global object and silently flips feature flags.
Pollution probe
Primary Flows
- Merge endpoint POST {__proto__:{isAdmin:true}}
- Effective state Shows polluted flags
Signals
Merge
function merge(t,s){ for(let k in s) if(typeof s[k]=="object") merge(t[k]||={},s[k]); else t[k]=s[k] }