Node.js

Prototype pollution in Node.js — where the runtime says "not our vulnerability", nobody else is standing

Prototype pollution is what happens when a special key in external input reaches JavaScript's built-in prototypes, usually through a recursive merge. Two outcomes: properties you never set appear everywhere (breaking authorization and option checks), or built-in methods vanish and the app crashes somewhere unrelated. The part that matters most is ownership — Node.js states this is not a vulnerability in Node.js core, and that defenses belong at the application and dependency level. Waiting for a fix is not a strategy here.