Collected research

Unveiling the Prototype Pollution Gadgets Finder

Raúl Miján · blog.doyensec.com

Automates discovery of server-side prototype pollution gadgets by polluting every field of a JSON request with payloads that set optional config properties of Node.js libraries, confirming them out-of-band via callbacks and then reverting them. Turns a pollution source into SSRF, data exfiltration or silent email interception.

Record

Researcher

Raúl Miján

Published by

blog.doyensec.com

Topic

Injection

In the archive

• Collected in the 2024 research round

Related sources

• Prototype Pollution Gadgets Finder

Tags

• prototype-pollution
• gadget-chain
• ssrf
• nodejs
• email
• info-leak
• javascript
• tooling
• owasp-a08-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Raúl Miján, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.