AIKIDO-2026-254207

TL;DR

A projection exclusion option passed to a MongoDB query can name __proto__ or another prototype chain property, and the db-connect query builder applies that exclusion by deleting the named property directly from the object rather than validating it first. An authenticated user who controls the projection can delete properties from Object.prototype itself, which is shared across the whole running process, and every other request handled by that process then loses access to the deleted prototype member and can crash or misbehave. The patch validates projection exclusion keys before applying them.