diff --git a/src/datetime.js b/src/datetime.js
index 00d80eab..b6577619 100644
--- a/src/datetime.js
+++ b/src/datetime.js
@@ -74,7 +74,7 @@ const dateTime = (function () {
         return words;
     }
 
-    const wordValues = {};
+    const wordValues = Object.create(null);
     few.forEach(function (word, index) {
         wordValues[word.toLowerCase()] = index;
     });
@@ -940,11 +940,11 @@ const dateTime = (function () {
      * @returns {object} - regex
      */
     function generateRegex(formatSpec) {
-        var matcher = {};
+        var matcher = Object.create(null);
         if (formatSpec.type === 'datetime') {
             matcher.type = 'datetime';
             matcher.parts = formatSpec.parts.map(function (part) {
-                var res = {};
+                var res = Object.create(null);
                 if (part.type === 'literal') {
                     res.regex = part.value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
                 } else if (part.component === 'Z' || part.component === 'z') {
@@ -988,7 +988,7 @@ const dateTime = (function () {
                 } else {
                     // must be a month or day name
                     res.regex = '[a-zA-Z]+';
-                    var lookup = {};
+                    var lookup = Object.create(null);
                     if (part.component === 'M' || part.component === 'x') {
                         // months
                         months.forEach(function (name, index) {
@@ -1176,7 +1176,7 @@ const dateTime = (function () {
             const tmA = 23;   // binary 010111
             const tmB = 47;   // binary 101111
 
-            const components = {};
+            const components = Object.create(null);
             for (let i = 1; i < info.length; i++) {
                 const mpart = matchSpec.parts[i - 1];
                 if (mpart.parse) {
diff --git a/src/functions.js b/src/functions.js
index 5b7bfb88..b48036b4 100644
--- a/src/functions.js
+++ b/src/functions.js
@@ -1648,7 +1648,7 @@ const functions = (() => {
 
         if (Array.isArray(arg)) {
             // merge the keys of all of the items in the array
-            var merge = {};
+            var merge = Object.create(null);
             arg.forEach(function (item) {
                 var allkeys = keys(item);
                 allkeys.forEach(function (key) {
@@ -1740,8 +1740,8 @@ const functions = (() => {
                 result = append(result, spread(item));
             });
         } else if (arg !== null && typeof arg === 'object' && !isLambda(arg)) {
-            for (var key in arg) {
-                var obj = {};
+            for (const key of Object.keys(arg)) {
+                var obj = Object.create(null);
                 obj[key] = arg[key];
                 result.push(obj);
             }
@@ -1763,10 +1763,10 @@ const functions = (() => {
             return undefined;
         }
 
-        var result = {};
+        var result = Object.create(null);
 
         arg.forEach(function (obj) {
-            for (var prop in obj) {
+            for (const prop of Object.keys(obj)) {
                 result[prop] = obj[prop];
             }
         });
@@ -1806,7 +1806,7 @@ const functions = (() => {
     function* each(obj, func) {
         var result = createSequence();
 
-        for (var key in obj) {
+        for (const key of Object.keys(obj)) {
             var func_args = hofFuncArgs(func, obj[key], key, obj);
             // invoke func
             var val = yield* func.apply(this, func_args);
@@ -2033,9 +2033,9 @@ const functions = (() => {
      * @returns {object} - sifted object
      */
     function* sift(arg, func) {
-        var result = {};
+        var result = Object.create(null);
 
-        for (var item in arg) {
+        for (const item of Object.keys(arg)) {
             var entry = arg[item];
             var func_args = hofFuncArgs(func, entry, item, arg);
             // invoke func
diff --git a/src/jsonata.js b/src/jsonata.js
index a22d83bd..f60bf7d3 100644
--- a/src/jsonata.js
+++ b/src/jsonata.js
@@ -226,7 +226,7 @@ var jsonata = (function() {
             resultSequence.keepSingleton = true;
         }
 
-        if (expr.hasOwnProperty('group')) {
+        if (Object.prototype.hasOwnProperty.call(expr, 'group')) {
             resultSequence = yield* evaluateGroupExpression(expr.group, isTupleStream ? tupleBindings : resultSequence, environment)
         }
 
@@ -235,7 +235,7 @@ var jsonata = (function() {
 
     function createFrameFromTuple(environment, tuple) {
         var frame = createFrame(environment);
-        for(const prop in tuple) {
+        for(const prop of Object.keys(tuple)) {
             frame.bind(prop, tuple[prop]);
         }
         return frame;
@@ -278,13 +278,13 @@ var jsonata = (function() {
             resultSequence = result[0];
         } else {
             // flatten the sequence
-            result.forEach(function(res) {
+            Array.prototype.forEach.call(result, function(res) {
                 if (!Array.isArray(res) || res.cons) {
                     // it's not an array - just push into the result sequence
                     resultSequence.push(res);
                 } else {
                     // res is a sequence - flatten it into the parent sequence
-                    res.forEach(val => resultSequence.push(val));
+                    Array.prototype.forEach.call(res, val => resultSequence.push(val));
                 }
             });
         }
@@ -356,7 +356,7 @@ var jsonata = (function() {
                     res = [res];
                 }
                 for (var bb = 0; bb < res.length; bb++) {
-                    tuple = {};
+                    tuple = Object.create(null);
                     Object.assign(tuple, tupleBindings[ee]);
                     if(res.tupleStream) {
                         Object.assign(tuple, res[bb]);
@@ -429,7 +429,7 @@ var jsonata = (function() {
                     res = [res];
                 }
                 if (isArrayOfNumbers(res)) {
-                    res.forEach(function (ires) {
+                    Array.prototype.forEach.call(res, function (ires) {
                         // round it down
                         var ii = Math.floor(ires);
                         if (ii < 0) {
@@ -627,7 +627,7 @@ var jsonata = (function() {
             flattened = [];
         }
         if(Array.isArray(arg)) {
-            arg.forEach(function (item) {
+            Array.prototype.forEach.call(arg, function (item) {
                 flatten(item, flattened);
             });
         } else {
@@ -668,7 +668,7 @@ var jsonata = (function() {
             results.push(input);
         }
         if (Array.isArray(input)) {
-            input.forEach(function (member) {
+            Array.prototype.forEach.call(input, function (member) {
                 recurseDescendants(member, results);
             });
         } else if (input !== null && typeof input === 'object') {
@@ -903,8 +903,8 @@ var jsonata = (function() {
      * @returns {{}} Evaluated input data
      */
     function* evaluateGroupExpression(expr, input, environment) {
-        var result = {};
-        var groups = {};
+        var result = Object.create(null);
+        var groups = Object.create(null);
         var reduce = input && input.tupleStream ? true : false;
         // group the input sequence by 'key' expression
         if (!Array.isArray(input)) {
@@ -933,7 +933,7 @@ var jsonata = (function() {
 
                 if (key !== undefined) {
                     var entry = {data: item, exprIndex: pairIndex};
-                    if (groups.hasOwnProperty(key)) {
+                    if (Object.prototype.hasOwnProperty.call(groups, key)) {
                         // a value already exists in this slot
                         if(groups[key].exprIndex !== pairIndex) {
                             // this key has been generated by another expression in this group
@@ -979,10 +979,10 @@ var jsonata = (function() {
         if(!Array.isArray(tupleStream)) {
             return tupleStream;
         }
-        var result = {};
+        var result = Object.create(null);
         Object.assign(result, tupleStream[0]);
         for(var ii = 1; ii < tupleStream.length; ii++) {
-            for(const prop in tupleStream[ii]) {
+            for(const prop of Object.keys(tupleStream[ii])) {
                 result[prop] = fn.append(result[prop], tupleStream[ii][prop]);
             }
         }
@@ -1317,7 +1317,7 @@ var jsonata = (function() {
                             };
                         }
                         // merge the update
-                        for(var prop in update) {
+                        for(const prop of Object.keys(update)) {
                             match[prop] = update[prop];
                         }
                     }
@@ -1652,7 +1652,7 @@ var jsonata = (function() {
     function* applyProcedure(proc, args) {
         var result;
         var env = createFrame(proc.environment);
-        proc.arguments.forEach(function (param, index) {
+        Array.prototype.forEach.call(proc.arguments, function (param, index) {
             env.bind(param.value, args[index]);
         });
         if (typeof proc.body === 'function') {
@@ -1674,7 +1674,7 @@ var jsonata = (function() {
         // create a closure, bind the supplied parameters and return a function that takes the remaining (?) parameters
         var env = createFrame(proc.environment);
         var unboundArgs = [];
-        proc.arguments.forEach(function (param, index) {
+        Array.prototype.forEach.call(proc.arguments, function (param, index) {
             var arg = args[index];
             if (arg && arg.type === 'operator' && arg.value === '?') {
                 unboundArgs.push(param);
@@ -1836,14 +1836,14 @@ var jsonata = (function() {
      * @returns {{bind: bind, lookup: lookup}} Created frame
      */
     function createFrame(enclosingEnvironment) {
-        var bindings = {};
+        var bindings = Object.create(null);
         return {
             bind: function (name, value) {
                 bindings[name] = value;
             },
             lookup: function (name) {
                 var value;
-                if(bindings.hasOwnProperty(name)) {
+                if(Object.prototype.hasOwnProperty.call(bindings, name)) {
                     value = bindings[name];
                 } else if (enclosingEnvironment) {
                     value = enclosingEnvironment.lookup(name);
@@ -2113,7 +2113,7 @@ var jsonata = (function() {
                     var exec_env;
                     // the variable bindings have been passed in - create a frame to hold these
                     exec_env = createFrame(environment);
-                    for (var v in bindings) {
+                    for (const v of Object.keys(bindings)) {
                         exec_env.bind(v, bindings[v]);
                     }
                 } else {
diff --git a/src/parser.js b/src/parser.js
index adb525ad..68622cd8 100644
--- a/src/parser.js
+++ b/src/parser.js
@@ -325,7 +325,7 @@ const parser = (() => {
         var node;
         var lexer;
 
-        var symbol_table = {};
+        var symbol_table = Object.create(null);
         var errors = [];
 
         var remainingTokens = function () {
diff --git a/src/signature.js b/src/signature.js
index f0972773..bd511315 100644
--- a/src/signature.js
+++ b/src/signature.js
@@ -31,7 +31,7 @@ const signature = (() => {
         // step through the signature, one symbol at a time
         var position = 1;
         var params = [];
-        var param = {};
+        var param = Object.create(null);
         var prevParam = param;
         while (position < signature.length) {
             var symbol = signature.charAt(position);
@@ -44,7 +44,7 @@ const signature = (() => {
             var next = function () {
                 params.push(param);
                 prevParam = param;
-                param = {};
+                param = Object.create(null);
             };
 
             var findClosingBracket = function (str, start, openSymbol, closeSymbol) {