From 903597a48d7c511c9208b7c1f41bb5cc74a6a5fe Mon Sep 17 00:00:00 2001
From: Daniel Roe <daniel@roe.dev>
Date: Tue, 4 Mar 2025 21:32:12 +0000
Subject: [PATCH] fix(nuxt): skip deep merge in dev mode for prototype keys
(#31205)
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
---
packages/nuxt/src/app/config.ts | 1 +
1 file changed, 1 insertion(+)
diff --git a/packages/nuxt/src/app/config.ts b/packages/nuxt/src/app/config.ts
index 14b63c0739..f0e653fc6f 100644
--- a/packages/nuxt/src/app/config.ts
+++ b/packages/nuxt/src/app/config.ts
@@ -35,6 +35,7 @@ function deepDelete (obj: any, newObj: any) {
function deepAssign (obj: any, newObj: any) {
for (const key in newObj) {
+ if (key === '__proto__' || key === 'constructor') { continue }
const val = newObj[key]
if (isPojoOrArray(val)) {
const defaultVal = Array.isArray(val) ? [] : {}