DeepFrontend
Learning Paths
Practice
System Design & DS
Design Studio
Data Structures Curriculum
Real-World Case Studies
Careers
Job Board
Resume Builder
Blog
Sign in
Search
⌘K
Go Pro
Loading compiler resources...
Node.js Quiz Practice
Active Recall Drill Session
← Exit Session
Question 1 of 1
medium
Node.js
A code review finds a deep-merge utility applied directly to req.body with no key filtering, feeding into an internal config object. What's the most direct risk?
A
No risk — req.body is always safe
B
Prototype pollution — attacker-controlled __proto__/constructor keys in req.body could pollute Object.prototype process-wide
C
This only risks a minor performance issue
D
The risk only applies to GET requests
Check Answer