Collected research

Abusing Hidden Properties to Attack the Node.js Ecosystem

Feng Xiao, Jianwei Huang, Yichang Xiong, Guangliang Yang, Hong Hu, Guofei Gu and Wenke Lee · usenix.org

Hidden property abusing exploits the gap between how client-supplied objects are serialised and how server code reads them, letting a remote attacker inject internal object properties the developer never meant to expose.

Record

Researcher

Feng Xiao, Jianwei Huang, Yichang Xiong, Guangliang Yang, Hong Hu, Guofei Gu and Wenke Lee

Published by

usenix.org

Topic

Server

In the archive

• Collected in the 2021 research round

Related sources

• Discovering Hidden Properties to Attack the Node.js Ecosystem
• DEF CON Safe Mode - Feng Xiao - Discovering Hidden Properties to Attack Node js Ecosystem
• USENIX Security '21 - Abusing Hidden Properties to Attack the Node.js Ecosystem

Tags

• prototype-pollution
• mass-assignment
• injection
• auth-bypass
• info-leak
• dos
• nodejs
• javascript
• static-analysis
• tooling
• owasp-a01-2021
• owasp-a03-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Feng Xiao, Jianwei Huang, Yichang Xiong, Guangliang Yang, Hong Hu, Guofei Gu and Wenke Lee, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.