AIKIDO-2026-11104

TL;DR

The @middy/http-json-body-parser middleware parses incoming HTTP request bodies as JSON using a reviver that only stripped the __proto__ key. Request bodies using a constructor key with a nested prototype object bypass this filter, so prototype-polluting keys survive parsing. When the parsed body is later merged or copied by the application, this can corrupt object prototypes, leading to denial of service or altered application behavior. The fix rejects bodies containing __proto__ or constructor.prototype keys with an HTTP 422 error.