JavaScript ES2026

Apply to all ES2026 code, including adapters, generated code, and framework boundaries. Validate at every receiving browser, server, worker, extension, package, storage, and message boundary, including DOM attributes, URLs, and third-party data. Check deployed engines' host APIs; apply browser and DOM rules only in their host.

Validation

• Validate runtime input regardless of JSDoc, editor hints, or TypeScript types. For security-sensitive commands, configuration, and protocol messages, use allowlisted schemas that reject unknown fields.
• Check primitive type, size, and encoding before normalization, then normalized syntax, range, and length.
• Keep raw input separate; pass only validated values downstream.
• Authorize every protected web operation and object server-side; browser checks and client roles grant nothing.

Dynamic code

• Never give untrusted strings to eval, Function, string timers, or dynamic compilers. Dispatch selected operations through trusted function tables.
• Map untrusted import() specifiers through an exact allowlist.
• Keep code out of JSON, database fields, feature flags, templates, and editable config. Never deserialize functions or revive callbacks, classes, or proxy handlers.

Objects

• Use Object.create(null) or Map for attacker keys. Reject __proto__, prototype, and constructor before recursive merges/assignments; test helpers for prototype pollution.
• Use Object.hasOwn for own-property checks controlling authorization or flow.
• Recursively protect shared security data or keep independent private copies: