Prerequisites
Mongoose version
9.3.3
Node.js version
22.21.1
MongoDB server version
4.4.24
Typescript version (if applicable)
N/A
Description
Trying to save a property named __proto__ in a Mixed schema path doesn't save that property. It works when using the mongodb driver directly, so this seems to be a bug in Mongoose.
Steps to Reproduce
const MyModelSchema = new mongoose.Schema({
path1: mongoose.Schema.Types.Mixed
});
const MyModel = mongoose.model("MyModel", MyModelSchema);
const r1 = await MyModel.create({path1: {}});
const r2 = await MyModel.findOneAndUpdate({_id: r1._id}, {$set: {path1: {["__proto__"]: "abcd"}}}, {returnDocument: "after"});
console.log(r2); // r2.path1 is {}
(Note: an object literal with ["__proto__"] as a computed key makes __proto__ an ordinary key; it does not set the prototype of the object.)
Expected Behavior
r2.path1 should be {["__proto__"]: "abcd"}
Prerequisites
Mongoose version
9.3.3
Node.js version
22.21.1
MongoDB server version
4.4.24
Typescript version (if applicable)
N/A
Description
Trying to save a property named
__proto__in a Mixed schema path doesn't save that property. It works when using the mongodb driver directly, so this seems to be a bug in Mongoose.Steps to Reproduce
(Note: an object literal with
["__proto__"]as a computed key makes__proto__an ordinary key; it does not set the prototype of the object.)Expected Behavior
r2.path1should be{["__proto__"]: "abcd"}