Mathematical expression evaluator fork with exports map, prototype pollution and code injection security fixes

Detect the use of vulnerable features within some libraries from https://github.com/HoLyVieR/prototype-pollution-nsec18/ that are not yet fixed

NoPP (No Prototype Pollution) – tiny helper to protect against Prototype Pollution vulnerabilities in your application

Detect the use of prototype pollution vulnerabilities

A test kit for detecting prototype pollution and gadgets

Secure YAML parser — duplicate key detection, alias depth limiting, prototype pollution prevention

Mathematical expression evaluator fork with exports map, prototype pollution and code injection security fixes

Prototype pollution finder tool for javascript. pp-finder lets you find prototype pollution candidates in your code. The main purpose of this tool is to help hackers in there prototype pollution researchs by highlighting potential candidate in the source

Request-level defence in depth for Axiomify — XSS sanitisation, HPP normalisation, prototype-pollution + null-byte filtering, bot UA detection.

TypeScript library for safe and efficient JSON data manipulation with RFC 6901 (JSON Pointer) and RFC 6902 (JSON Patch) compliance, featuring prototype pollution protection and immutable operations

A service which detects prototype pollution in libraries

Tiny, type-safe deep merge — immutable, prototype-pollution safe, with configurable array strategy. Zero dependencies.

Prevent prototype pollution by sanitizing all string inputs to the JSON parser

Secure fork of SheetJS with security fixes for prototype pollution and ReDoS vulnerabilities

Inside-the-app security middleware for Node.js. Express and NestJS run the full sanitizer pipeline (XSS, SQL, NoSQL, SSTI, XXE, path, command, prompt injection, prototype pollution, LDAP, XPath, header injection, plus 20+ more attack types). Fastify, Koa,

Fork isvalid 1.6.7 - Patch merge 1.2.2 CVE (Prototype Pollution) The Unkillable Fork

CWE-aligned static scanner for high-yield vulnerability patterns (SSRF, path traversal, prototype pollution, auth bypass, and more) in JS/TS codebases.

Express 4/5-compatible middleware to strip MongoDB operator injection ($ne, $where, $gt...), dot-notation field targeting, and prototype pollution from req.body/params/query.

Access deep object properties using a path

Provide secure alternatives for functions that can be effected by prototype pollution