diff --git a/index.js b/index.js
index 82271f6..e9273dc 100644
--- a/index.js
+++ b/index.js
@@ -96,7 +96,7 @@ function createError () {
   }
 
   for (var key in props) {
-    if (key !== 'status' && key !== 'statusCode') {
+    if (key !== 'status' && key !== 'statusCode' && key !== '__proto__') {
       err[key] = props[key]
     }
   }
diff --git a/test/test.js b/test/test.js
index 7db9f16..c419aa5 100644
--- a/test/test.js
+++ b/test/test.js
@@ -49,6 +49,21 @@ describe('createError(status)', function () {
 
       assert.strictEqual(httpError, nativeError)
     })
+
+    it('should not allow a __proto__ property to alter the prototype', function () {
+      var nativeError = new Error('This is a test error')
+
+      var httpError = createError(404, nativeError, JSON.parse('{"__proto__":{"evil":true}}'))
+
+      assert.strictEqual(httpError.status, 404)
+      assert.strictEqual(httpError.evil, undefined)
+
+      assert(httpError instanceof Error)
+
+      assert.strictEqual(Object.getPrototypeOf(httpError), Error.prototype)
+
+      assert.strictEqual(httpError, nativeError)
+    })
   })
 
   describe('when status 300', function () {