CVE-2026-3030 – Prototype Pollution in JSON Merge Patch

Program Code (Node.js)

// server.js - Vulnerable REST API with deep merge
const express = require('express');
const app = express();
app.use(express.json());

let config = {
    role: 'user',
    settings: {}
};

// Insecure deep merge function (pollutable via __proto__)
function deepMerge(target, source) {
    for (const key in source) {
        if (source[key] && typeof source[key] === 'object' && !Array.isArray(source[key])) {
            if (!target[key]) target[key] = {};
            deepMerge(target[key], source[key]);
        } else {
            target[key] = source[key];
        }
    }
    return target;
}

app.patch('/config', (req, res) => {
    deepMerge(config, req.body);
    res.json(config);
});

app.get('/admin', (req, res) => {
    // Check admin via a property that could be polluted
    if (config.role === 'admin' || config.isAdmin) {
        res.send('Welcome Admin!');
    } else {
        res.status(403).send('Forbidden');
    }
});

app.listen(3000, () => console.log('Server on :3000'));

CVE-2026-3030 – Prototype Pollution via JSON Merge Patch

Overview

A Node.js API uses a vulnerable deep merge function to apply JSON patches. By sending __proto__ as a key, an attacker can pollute the global object prototype, adding or overriding properties such as isAdmin, leading to privilege escalation.

Vulnerability Details

Type: Prototype Pollution
Impact: Privilege escalation, denial of service, sometimes RCE.
Root Cause: The deepMerge function copies keys without checking for __proto__ or constructor, allowing injection into Object.prototype.

Exploit Demonstration

Start the server:
```
npm install express
node server.js
```
Run the exploit:
```
python exploit_prototype_pollution.py
```

Most Popular

CVE-2026-3030-Prototype-Pollution-in-JSON-Merge-Patch