diff --git a/dist/merge.browser.min.js b/dist/merge.browser.min.js
index 4a48869..af170f3 100644
--- a/dist/merge.browser.min.js
+++ b/dist/merge.browser.min.js
@@ -1 +1 @@
-var merge;merge=(()=>{"use strict";var r={496:(r,e)=>{function t(){for(var r=[],e=0;e<arguments.length;e++)r[e]=arguments[e];return n.apply(void 0,r)}function n(){for(var r=[],e=0;e<arguments.length;e++)r[e]=arguments[e];return f(!0===r[0],!1,r)}function o(){for(var r=[],e=0;e<arguments.length;e++)r[e]=arguments[e];return f(!0===r[0],!0,r)}function i(r){if(Array.isArray(r)){for(var e=[],t=0;t<r.length;++t)e.push(i(r[t]));return e}if(u(r)){for(var t in e={},r)e[t]=i(r[t]);return e}return r}function u(r){return r&&"object"==typeof r&&!Array.isArray(r)}function a(r,e){if(!u(r))return e;for(var t in e)r[t]=u(r[t])&&u(e[t])?a(r[t],e[t]):e[t];return r}function f(r,e,t){var n;!r&&u(n=t.shift())||(n={});for(var o=0;o<t.length;++o){var f=t[o];if(u(f))for(var c in f)if("__proto__"!==c&&"constructor"!==c&&"prototype"!==c){var v=r?i(f[c]):f[c];n[c]=e?a(n[c],v):v}}return n}Object.defineProperty(e,"__esModule",{value:!0}),e.isPlainObject=e.clone=e.recursive=e.merge=e.main=void 0,r.exports=e=t,e.default=t,e.main=t,t.clone=i,t.isPlainObject=u,t.recursive=o,e.merge=n,e.recursive=o,e.clone=i,e.isPlainObject=u}},e={};return function t(n){if(e[n])return e[n].exports;var o=e[n]={exports:{}};return r[n](o,o.exports,t),o.exports}(496)})().default;
\ No newline at end of file
+var merge;merge=(()=>{"use strict";var r={496:(r,e)=>{function t(){for(var r=[],e=0;e<arguments.length;e++)r[e]=arguments[e];return n.apply(void 0,r)}function n(){for(var r=[],e=0;e<arguments.length;e++)r[e]=arguments[e];return f(!0===r[0],!1,r)}function o(){for(var r=[],e=0;e<arguments.length;e++)r[e]=arguments[e];return f(!0===r[0],!0,r)}function i(r){if(Array.isArray(r)){for(var e=[],t=0;t<r.length;++t)e.push(i(r[t]));return e}if(u(r)){for(var t in e={},r)e[t]=i(r[t]);return e}return r}function u(r){return r&&"object"==typeof r&&!Array.isArray(r)}function a(r,e){if(!u(r))return e;for(var t in e)"__proto__"!==t&&"constructor"!==t&&"prototype"!==t&&(r[t]=u(r[t])&&u(e[t])?a(r[t],e[t]):e[t]);return r}function f(r,e,t){var n;!r&&u(n=t.shift())||(n={});for(var o=0;o<t.length;++o){var f=t[o];if(u(f))for(var c in f)if("__proto__"!==c&&"constructor"!==c&&"prototype"!==c){var s=r?i(f[c]):f[c];n[c]=e?a(n[c],s):s}}return n}Object.defineProperty(e,"__esModule",{value:!0}),e.isPlainObject=e.clone=e.recursive=e.merge=e.main=void 0,r.exports=e=t,e.default=t,e.main=t,t.clone=i,t.isPlainObject=u,t.recursive=o,e.merge=n,e.recursive=o,e.clone=i,e.isPlainObject=u}},e={};return function t(n){if(e[n])return e[n].exports;var o=e[n]={exports:{}};return r[n](o,o.exports,t),o.exports}(496)})().default;
\ No newline at end of file
diff --git a/dist/merge.browser.test.js b/dist/merge.browser.test.js
index 9c3dc3e..fd05f2d 100644
--- a/dist/merge.browser.test.js
+++ b/dist/merge.browser.test.js
@@ -62,10 +62,13 @@ exports.isPlainObject = isPlainObject;
 function _recursiveMerge(base, extend) {
     if (!isPlainObject(base))
         return extend;
-    for (var key in extend)
+    for (var key in extend) {
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+            continue;
         base[key] = (isPlainObject(base[key]) && isPlainObject(extend[key])) ?
             _recursiveMerge(base[key], extend[key]) :
             extend[key];
+    }
     return base;
 }
 function _merge(isClone, isRecursive, items) {
@@ -194,6 +197,9 @@ describe('merge.recursive', function () {
     });
     it('prototype pollution attack', function () {
         chai_1.assert.deepEqual(index_1.default.recursive({}, JSON.parse('{"__proto__": {"a": true}}')), {});
+        chai_1.assert.equal({}['a'], undefined);
+        chai_1.assert.deepEqual(index_1.default.recursive({ deep: {} }, JSON.parse('{ "deep": { "__proto__": {"b": true} }}')), { deep: {} });
+        chai_1.assert.equal({}['b'], undefined);
     });
 });
 
diff --git a/lib/src/index.js b/lib/src/index.js
index 9332816..f239e44 100644
--- a/lib/src/index.js
+++ b/lib/src/index.js
@@ -55,10 +55,13 @@ exports.isPlainObject = isPlainObject;
 function _recursiveMerge(base, extend) {
     if (!isPlainObject(base))
         return extend;
-    for (var key in extend)
+    for (var key in extend) {
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype')
+            continue;
         base[key] = (isPlainObject(base[key]) && isPlainObject(extend[key])) ?
             _recursiveMerge(base[key], extend[key]) :
             extend[key];
+    }
     return base;
 }
 function _merge(isClone, isRecursive, items) {
diff --git a/lib/test/index.js b/lib/test/index.js
index aaa23a7..c322044 100644
--- a/lib/test/index.js
+++ b/lib/test/index.js
@@ -99,5 +99,8 @@ describe('merge.recursive', function () {
     });
     it('prototype pollution attack', function () {
         chai_1.assert.deepEqual(index_1.default.recursive({}, JSON.parse('{"__proto__": {"a": true}}')), {});
+        chai_1.assert.equal({}['a'], undefined);
+        chai_1.assert.deepEqual(index_1.default.recursive({ deep: {} }, JSON.parse('{ "deep": { "__proto__": {"b": true} }}')), { deep: {} });
+        chai_1.assert.equal({}['b'], undefined);
     });
 });
diff --git a/src/index.ts b/src/index.ts
index 9b84bac..42f7082 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -61,10 +61,12 @@ function _recursiveMerge(base: any, extend: any) {
 	if (!isPlainObject(base))
 		return extend
 
-	for (const key in extend)
+	for (const key in extend) {
+		if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue
 		base[key] = (isPlainObject(base[key]) && isPlainObject(extend[key])) ?
 			_recursiveMerge(base[key], extend[key]) :
 			extend[key]
+	}
 
 	return base
 
diff --git a/test/index.ts b/test/index.ts
index f898192..dc93bc2 100644
--- a/test/index.ts
+++ b/test/index.ts
@@ -219,6 +219,15 @@ describe('merge.recursive', function () {
 			{}
 		)
 
+		assert.equal(({} as any)['a'], undefined)
+
+		assert.deepEqual(
+			merge.recursive({ deep: {} }, JSON.parse('{ "deep": { "__proto__": {"b": true} }}')),
+			{ deep: {} }
+		)
+
+		assert.equal(({} as any)['b'], undefined)
+
 	})
 
 })
\ No newline at end of file