Stop 21 of 42 · Account Access · Body & parameter fuzzing

Handing in oddly shaped slips

A well-behaved customer fills in a deposit slip: an amount, a number. Mallory hands in strange slips instead. A negative amount. A word where a number goes. A slip with another slip folded inside. She is not guessing a password, she is watching what confuses the teller.

Severity Medium to CriticalCategory Injection RiskAccount AccessSources checked 25 Oct 2026

Watch it happen

Play it as

Mallory hands in a negative amount, a word where a number goes, and a slip hiding another slip. The teller trusts all three and the app’s defaults change.

Arrival

Mallory walks in with a deposit slip. She is not guessing a password, she is about to watch what confuses the teller.

Mallory says: One deposit, please.
1 / 5

In bank terms and app terms

In the bankIn your app
Oddly shaped slipJSON body fields with unexpected values, types or nested keys
Teller’s machine jammingA 500 error or crash when null, an array or a huge number shows up where a string is expected
Slip tucked in a slipKeys like __proto__ or constructor.prototype that can change defaults on every object
Slip checkerSchema validation (zod, joi) on every request body, with unknown keys stripped

Are you exposed?

You might be exposed if…
  • Your routes read request.json() and use the values straight away, with no schema.
  • You merge or spread incoming objects into other objects (deepMerge, Object.assign, lodash merge).
  • Sending null, -1, 0 or a very large number to your API gives a 500 error instead of a clean 400.
What to do about it
  1. Validate every request body with a strict schema (types, ranges, lengths) and return 400 for anything else.
  2. Strip or reject __proto__, constructor and prototype keys before merging, and keep libraries like lodash up to date.
  3. Treat amounts, quantities and prices as server-checked numbers: reject negatives and zero where they make no sense.

Track these in your to-do list →

It has happened to real companies

Real-world breaches

Lodash CVE-2019-10744 (2019) — Versions of Lodash before 4.17.12 had a prototype pollution flaw: the defaultsDeep function could be tricked into adding or modifying properties of Object.prototype using a constructor payload. Snyk, which reported it, said Lodash was downloaded over 80 million times a month.

jQuery CVE-2019-11358 (2019) — Prototype pollution in $.extend() affected jQuery versions before 3.4.0.

What it looks like in code

// GOOD: Parse the body into an explicit allowlist (unknown keys are dropped)
import { z } from "zod"

const UpdateProfile = z.object({
  display_name: z.string().max(100).optional(),
  avatar_url: z.string().url().optional(),
})

const body = UpdateProfile.parse(await request.json())

Ask your AI tool to fix it

Paste this into Cursor, Claude, Lovable, Bolt or whatever you build with.

Prompt
Add strict schema validation (zod) to every API route that reads a request body: define exact types, min/max ranges and string lengths, strip unknown keys, and return a 400 with a clear message on failure. Reject negative or zero amounts where they make no sense, and make sure no code merges user-provided objects into other objects without removing __proto__, constructor and prototype keys.

Where this comes from

The facts, figures and fixes on this page were checked against these sources on 25 Oct 2026. They are linked so you can check for yourself.

Spot a mistake or something out of date? Report a correction · How these guides are made and checked

Go deeper in isitsecure

The free, open-source scanner checks for most of the problems in these guides.