Endo is a distributed secure JavaScript sandbox, based on SES

A fast tool to scan client-side prototype pollution vulnerability written in Rust. 🦀

A scanner/exploitation tool written in GO, which leverages client-side Prototype Pollution to XSS by exploiting known gadgets.

Advanced Client-Side Prototype Pollution Scanner

A collection of Server-Side Prototype Pollution gadgets and exploits

Next.js React Server Components RCE exploit for CVE-2025-55182

Let's check if your target is vulnerable for client side prototype pollution.

A tool which helps identifying client-side prototype polluting libraries

A website developed with Nodejs. This website includes server side prototype pollution vulnerability

Detecting prototype pollution vulnerabilities in JavaScript using static analysis

Secure drop-in replacement for the `JSON` global with prototype pollution protection

Application-layer security middleware for Express.js with attack detection, rate limiting, brute-force protection and threat events.

🔒 Type-safe, secure nested property retriever with bracket notation & automatic function context binding.

Sub-millisecond security layer for Node.js. Enterprise-grade defense featuring cost-based rate limiting, HMAC request signing, active session-hijacking protection, and JA4 fingerprinting.

Proof-of-concept research tool for CVE-2025-55182, a critical unauthenticated RCE in Next.js App Router caused by server-side object injection in React Server Components and Server Actions, including UTF-16LE WAF evasion techniques.

Security Research and PoC

Different unrelated stuff which can not be categorized by qualifying feature

A CTF challenge we put together for Ekoparty's 2023 main CTF

A sample application vulnerable to JavaScript prototype pollution

0-Day Research: Incomplete Fix Bypass in nested-property v4.0.0 — Array.prototype & Function.prototype Pollution | by Ojas Mehta