AIKIDO-2026-580810

TL;DR

The convertTokenData utility builds a nested object from token keys when called with object output. It splits each token key on dots and descends into the growing object without rejecting inherited property names such as constructor or prototype. A token key beginning with constructor.prototype therefore reaches Object.prototype, letting externally influenced token data mutate global prototype state in the Node.js process and impacting integrity and availability. The fix constructs the output on a null-prototype object so traversal can no longer escape into Object.prototype.