fix(server): guard collection lookup against prototype keys (#488)

itsmelouis · atinux · web-flow · commit 45025222e411 · 2026-06-02T15:05:10.000+02:00
Co-authored-by: Sébastien Chopin &lt;seb@nuxt.com&gt;
diff --git a/src/runtime/server/api.ts b/src/runtime/server/api.ts
@@ -23,7 +23,7 @@ function getInstallCommand(pkg: string): string {
 export default defineCachedEventHandler(async (event: H3Event) => {
   const options = useAppConfig().icon as NuxtIconRuntimeOptions
   const collectionName = event.context.params?.collection?.replace(/\.json$/, '')
-  const collection = collectionName
+  const collection = collectionName && Object.hasOwn(collections, collectionName)
     ? await collections[collectionName]?.()
     : null
 
