Skip to content

Mixed fields cannot contain keys named __proto__ #16202

@zbjornson

Description

@zbjornson

Prerequisites

  • I have written a descriptive issue title
  • I have searched existing issues to ensure the bug has not already been reported

Mongoose version

9.3.3

Node.js version

22.21.1

MongoDB server version

4.4.24

Typescript version (if applicable)

N/A

Description

Trying to save a property named __proto__ in a Mixed schema path doesn't save that property. It works when using the mongodb driver directly, so this seems to be a bug in Mongoose.

Steps to Reproduce

const MyModelSchema = new mongoose.Schema({
  path1: mongoose.Schema.Types.Mixed
});

const MyModel = mongoose.model("MyModel", MyModelSchema);

const r1 = await MyModel.create({path1: {}});
const r2 = await MyModel.findOneAndUpdate({_id: r1._id}, {$set: {path1: {["__proto__"]: "abcd"}}}, {returnDocument: "after"});
console.log(r2); // r2.path1 is {}

(Note: an object literal with ["__proto__"] as a computed key makes __proto__ an ordinary key; it does not set the prototype of the object.)

Expected Behavior

r2.path1 should be {["__proto__"]: "abcd"}

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions