clone() doesn't clone own 'hasOwnProperty' field if Object.prototype is frozen
Author: tonyofbyteballCreated Feb 19, 2026Updated Jul 12, 2026
Labelsbug
Example:
const _ = require('lodash');
Object.freeze(Object.prototype);
const orig = {
foo: "bar",
hasOwnProperty: "a string"
};
console.log(orig.hasOwnProperty); // Output: "a string"
const cloned = _.clone(orig);
console.log(cloned.hasOwnProperty); // Output: "[Function: hasOwnProperty]", expected: "a string"
const spreadCopy = { ...orig };
console.log(spreadCopy.hasOwnProperty); // Output: "a string"
cloneDeep() demonstrates the same behavior.
The root cause seems to be in object[key] = value; assignment in baseAssignValue(). object['hasOwnProperty'] on the destination object resolves to the prototype's hasOwnProperty and the assignment is blocked, while the intention was to create an own property named hasOwnProperty.
Suggestion: always use defineProperty. The current implementation uses it only for __proto__.
Source: lodash/lodash