AIKIDO-2026-400467

TL;DR

The geobuf decoder builds feature properties objects in readProps by assigning decoded key/value pairs directly onto a plain object. A specially crafted geobuf message can carry a property key such as __proto__, constructor, or prototype, so decoding writes onto the object prototype instead of the properties object. Before the fix this pollutes Object.prototype across the application, enabling property injection and denial of service. The fix drops those unsafe keys while decoding.