# Prototype pollution attack (lodash / constructor.prototype)

lodash merge/mergeWith/defaultsDeep accept a constructor.prototype payload and pollute Object.prototype, enabling DoS and possible further impact.

- Payout: hidden
- Severity: high
- Program: Node.js third-party modules
- Found by: asgerf
- Disclosed: 2018-10-30
- CVE: CVE-2018-16487
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/380873
- Library page: https://bugbountylibrary.com/r/h1%3A380873
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:high tech:nodejs technique:incomplete-fix technique:source-review vuln:prototype-pollution

**Target:** lodash library functions merge, mergeWith, defaultsDeep
**Root cause:** merge/mergeWith/defaultsDeep recursively copy attacker-controlled keys including `constructor` and `prototype`, writing into Object.prototype instead of skipping these magic keys.
**Steps:**
1. Install lodash 4.17.10 and require it.
2. Build payload `JSON.parse('{"constructor": {"prototype": {"isAdmin": true}}}')`.
3. Call `_.merge({}, payload)`.
4. Observe `{}.isAdmin === true`, confirming Object.prototype pollution.
**How found:** Variant analysis of prior report 310443: recognized that the earlier fix covered `__proto__` but not the `constructor.prototype` path, then tested merge with that payload.
**Exploitation:** Attacker supplies a JSON body containing constructor.prototype keys to any endpoint that passes user input into _.merge/mergeWith/defaultsDeep; polluted Object.prototype properties then affect all objects in the process, causing DoS or logic bypass depending on the app.
**Escalation:** Depending on application sinks, polluted properties can flip auth checks or crash the process (DoS).
**Insight:** When a prototype-pollution fix blocks `__proto__`, retest the sibling path `constructor.prototype` against every recursive-merge helper (merge, mergeWith, defaultsDeep) — fixes often patch one key only.