Every JSON formatter shows it plainly: a key named __proto__ sitting in the middle of an otherwise normal API response. It looks harmless because nothing crashes. That is exactly the problem — the bug shows up two files later, in the code that copies the object.

I tested this in Node 22 with one payload:

{ "__proto__" : { "polluted" : "yes" } , "ok" : 1 }

Enter fullscreen mode

Exit fullscreen mode

JSON.parse() itself is safe. The key becomes an ordinary own property:

const obj = JSON . parse ( raw ) ; Object . keys ( obj ) ; // [ '__proto__', 'ok' ] obj . polluted ; // undefined obj . hasOwnProperty ( '__proto__' ) ; // true

Enter fullscreen mode

Exit fullscreen mode

So parsing is not the vulnerability. Copying is.

const merged = Object . assign ( { } , obj ) ; merged . polluted ; // 'yes' — inherited from the attacker's object ( { } ) .…