#6112·lodash

clone() doesn't clone own 'hasOwnProperty' field if Object.prototype is frozen

Author: tonyofbyteballCreated Feb 19, 2026Updated Jul 12, 2026
Labelsbug

Example:

const _ = require('lodash');
Object.freeze(Object.prototype);

const orig = {
  foo: "bar",
  hasOwnProperty: "a string"
};

console.log(orig.hasOwnProperty); // Output: "a string"

const cloned = _.clone(orig);
console.log(cloned.hasOwnProperty); // Output: "[Function: hasOwnProperty]", expected: "a string"

const spreadCopy = { ...orig };
console.log(spreadCopy.hasOwnProperty); // Output: "a string"

cloneDeep() demonstrates the same behavior.

The root cause seems to be in object[key] = value; assignment in baseAssignValue(). object['hasOwnProperty'] on the destination object resolves to the prototype's hasOwnProperty and the assignment is blocked, while the intention was to create an own property named hasOwnProperty.

Suggestion: always use defineProperty. The current implementation uses it only for __proto__.