diff --git a/‎API.md‎
Lines changed: 14 additions & 1 deletion b/‎API.md‎
Lines changed: 14 additions & 1 deletion
diff --git a/‎lib/types/keys.js‎
Lines changed: 18 additions & 1 deletion b/‎lib/types/keys.js‎
Lines changed: 18 additions & 1 deletion
diff --git a/‎test/types/object.js‎
Lines changed: 43 additions & 0 deletions b/‎test/types/object.js‎
Lines changed: 43 additions & 0 deletions
@@ -2550,7 +2550,7 @@ const value = await Joi.compile(schema).validateAsync(input);
 // value === { x123x: 'x', x1x: 'y', x0x: 'z', x4x: 'test' }
 ```
 
-Possible validation errors: [`object.rename.multiple`](#objectrenamemultiple), [`object.rename.override`](#objectrenameoverride)
+Possible validation errors: [`object.rename.multiple`](#objectrenamemultiple), [`object.rename.override`](#objectrenameoverride), [`object.rename.proto`](#objectrenameproto)
 
 #### `object.schema([type])`
 
@@ -4145,6 +4145,19 @@ Additional local context properties:
 }
 ```
 
+#### `object.rename.proto`
+
+The target property is `__proto__`, which would set the object prototype instead of creating a key.
+
+Additional local context properties:
+```ts
+{
+    from: string, // Origin property name of the rename
+    to: string, // Target property of the rename
+    pattern: boolean // Indicates if the rename source was a pattern (regular expression)
+}
+```
+
 #### `object.schema`
 
 The object was not a **joi** schema.
 
@@ -547,6 +547,7 @@ module.exports = Any.extend({
         'object.regex': '{{#label}} must be a RegExp object',
         'object.rename.multiple': '{{#label}} cannot rename {{:#from}} because multiple renames are disabled and another key was already renamed to {{:#to}}',
         'object.rename.override': '{{#label}} cannot rename {{:#from}} because override is disabled and target {{:#to}} exists',
+        'object.rename.proto': '{{#label}} cannot rename {{:#from}} because target {{:#to}} is a reserved key',
         'object.schema': '{{#label}} must be a Joi schema of {{#type}} type',
         'object.unknown': '{{#label}} is not allowed',
         'object.with': '{{:#mainWithLabel}} missing required peer {{:#peerWithLabel}}',
@@ -567,8 +568,15 @@ internals.clone = function (value, prefs) {
             return Clone(value, { shallow: true });
         }
 
-        const clone = Object.create(Object.getPrototypeOf(value));
+        const proto = Object.getPrototypeOf(value);
+        const clone = Object.create(proto);
         Object.assign(clone, value);
+
+        // Restore the prototype in case of pre-existing prototype pollution
+        if (Object.getPrototypeOf(clone) !== proto) {
+            Object.setPrototypeOf(clone, proto);
+        }
+
         return clone;
     }
 
@@ -867,6 +875,15 @@ internals.rename = function (schema, value, state, prefs, errors) {
                 }
             }
 
+            if (to === '__proto__') {
+                errors.push(schema.$_createError('object.rename.proto', value, { from, to, pattern }, state, prefs));
+                if (prefs.abortEarly) {
+                    return false;
+                }
+
+                continue;
+            }
+
             if (value[from] === undefined) {
                 delete value[to];
             }
 
@@ -105,6 +105,28 @@ describe('object', () => {
         expect(schema.validate(new Test()).value).to.be.instanceof(Test);
     });
 
+    it('does not pollute the cloned value prototype via a __proto__ key', () => {
+
+        const schema = Joi.object({ name: Joi.string() });
+
+        const payload = JSON.parse('{"name":"alice","__proto__":{"isAdmin":true,"role":"superuser"}}');
+        expect(Object.getPrototypeOf(payload)).to.equal(Object.prototype);
+        expect(payload.isAdmin).to.not.exist();
+
+        const { value, error } = schema.validate(payload);
+        expect(error).to.not.exist();
+        expect(Object.getPrototypeOf(value)).to.equal(Object.prototype);
+        expect(value.isAdmin).to.not.exist();
+        expect(value.role).to.not.exist();
+
+        // Same with allowUnknown disabled
+
+        const { value: value2, error: error2 } = schema.validate(payload, { allowUnknown: false });
+        expect(error2).to.not.exist();
+        expect(Object.getPrototypeOf(value2)).to.equal(Object.prototype);
+        expect(value2.isAdmin).to.not.exist();
+    });
+
     it('allows any key when schema is undefined', () => {
 
         Helper.validate(Joi.object(), [[{ a: 4 }, true]]);
@@ -3031,6 +3053,27 @@ describe('object', () => {
                 Helper.validate(Joi.compile(schema), [[{ other: 'here', A: 100, c: 50 }, true, { other: 'here', A: 100, b: 100, c: 50 }]]);
             });
 
+            it('errors on a template target rendering __proto__ instead of setting the prototype', () => {
+
+                const payload = JSON.parse('{"user":"alice","x-__proto__":{"isAdmin":true,"role":"superuser"}}');
+
+                const schema = Joi.object({ user: Joi.string().required() })
+                    .rename(/^x-(.+)$/, Joi.x('{#1}'), { multiple: true })
+                    .unknown(false);
+
+                const { value, error } = schema.validate(payload);
+                expect(error).to.be.an.error('"value" cannot rename "x-__proto__" because target "__proto__" is a reserved key');
+                expect(error.details[0].type).to.equal('object.rename.proto');
+                expect(Object.getPrototypeOf(value)).to.equal(Object.prototype);
+                expect(value.isAdmin).to.not.exist();
+                expect(Object.prototype.isAdmin).to.not.exist();
+
+                const { value: value2, error: error2 } = schema.validate(payload, { abortEarly: false });
+                expect(error2.details[0].type).to.equal('object.rename.proto');
+                expect(Object.getPrototypeOf(value2)).to.equal(Object.prototype);
+                expect(value2.isAdmin).to.not.exist();
+            });
+
             it('uses template', () => {
 
                 const schema = Joi.object()