The work on exploiting prototype pollution was excellent https://blog.s1r1us.ninja/research/PP

I didn’t know about the --disable-proto option in node or the Document Policy proposal for dealing with it.

Amazing that 80% of nested query parameter parsers were susceptible to prototype pollution.