Summary

v4.12.7 is a security-focused patch that hardens request body parsing. The parser now ignores __proto__ path segments when using parseBody({ dot: true }) to prevent potential prototype pollution that can occur when merged with unsafe dot-notation patterns.

Key Points

• What changed: parseBody({ dot: true }) will now ignore path segments equal to __proto__.
• Why: prevents prototype pollution vectors arising from dot-notation merging of untrusted inputs.
• Impact: security fix with no breaking API changes; only affects payloads that contain __proto__ path segments and use dot: true parsing.
• Recommended action: upgrade to v4.12.7 in deployments that accept untrusted JSON/form data; validate and normalize input where possible.
• Notes: see the full changelog (v4.12.6...v4.12.7) for commit details.