AIKIDO-2026-11077

TL;DR

Improper handling of user-controlled localeId values in registerLocaleData allowed writes into a plain object used as a shared internal registry, enabling keys such as constructor or prototype to trigger prototype pollution instead of being stored as ordinary data. In long-running SSR environments, this could taint object behavior across requests for the lifetime of the process. An attacker able to call the public API with a crafted locale identifier could inject attacker-controlled properties into Object.prototype, causing unexpected property inheritance, corrupted application state, information leakage through serialization or enumeration, and potentially broader security impact depending on how polluted objects are later consumed.