AIKIDO-2026-10467

TL;DR

Affected versions of this package are vulnerable to prototype pollution due to unsafe handling of the proto property during message initialization. The Message constructor processes user-controlled input objects and assigns their fields onto the message instance without restricting special keys, allowing attackers to supply a proto property that modifies the prototype of the created object. This can lead to prototype chain manipulation and unintended property injection across the application when polluted objects are later used.