From 5db47ead3d6a7fd7ec2e02df9002d404578354f4 Mon Sep 17 00:00:00 2001
From: Dinh Le <dinwwwh@gmail.com>
Date: Sat, 1 Aug 2026 21:00:08 +0700
Subject: [PATCH] fix(fetch): prevent __proto__ header from corrupting parsed
 headers object

---
 packages/fetch/src/headers.test.ts | 13 +++++++++++++
 packages/fetch/src/headers.ts      |  4 +++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/packages/fetch/src/headers.test.ts b/packages/fetch/src/headers.test.ts
index 86147d6..f505325 100644
--- a/packages/fetch/src/headers.test.ts
+++ b/packages/fetch/src/headers.test.ts
@@ -19,6 +19,19 @@ it('toStandardHeaders', () => {
   })
 })
 
+it('toStandardHeaders with a __proto__ header', () => {
+  const headers = new Headers()
+
+  headers.append('__proto__', 'polluted')
+  headers.append('content-type', 'application/json')
+
+  const standardHeaders = toStandardHeaders(headers)
+
+  expect(Object.getPrototypeOf(standardHeaders)).toBe(null)
+  expect(Object.getOwnPropertyDescriptor(standardHeaders, '__proto__')?.value).toBe('polluted')
+  expect(standardHeaders['content-type']).toBe('application/json')
+})
+
 it('toFetchHeaders', () => {
   const standardHeaders: StandardHeaders = {
     'content-type': 'application/json',
diff --git a/packages/fetch/src/headers.ts b/packages/fetch/src/headers.ts
index fcfc6e3..cf000b2 100644
--- a/packages/fetch/src/headers.ts
+++ b/packages/fetch/src/headers.ts
@@ -4,7 +4,9 @@ import type { StandardHeaders } from '@standardserver/core'
  * Convert fetch headers to standard headers.
  */
 export function toStandardHeaders(headers: Headers): StandardHeaders {
-  const standardHeaders: StandardHeaders = {}
+  // Null prototype so header names like __proto__ become plain own
+  // properties instead of touching the object's prototype.
+  const standardHeaders: StandardHeaders = Object.create(null)
 
   headers.forEach((value, key) => {
     if (Array.isArray(standardHeaders[key])) {