sidorares/node-mysql2 · error · Error

The field name (${field}) can't be the same as an object's p

Error message

The field name (${field}) can't be the same as an object's private property.

What it means

fieldEscape() rejects column/field names that collide with JavaScript Object private/prototype properties (`__proto__`, `__defineGetter__`, `__defineSetter__`, `__lookupGetter__`, `__lookupSetter__`). Assigning such a name as a property during row assembly would corrupt the result object's prototype chain. This is a prototype-pollution guard applied when building nested/evaluated field names.

Source

Thrown at lib/helpers.js:76

  return !!list;
}

exports.typeMatch = typeMatch;

const privateObjectProps = new Set([
  '__defineGetter__',
  '__defineSetter__',
  '__lookupGetter__',
  '__lookupSetter__',
  '__proto__',
]);

exports.privateObjectProps = privateObjectProps;

const fieldEscape = (field, isEval = true) => {
  if (privateObjectProps.has(field)) {
    throw new Error(
      `The field name (${field}) can't be the same as an object's private property.`
    );
  }

  return isEval ? srcEscape(field) : field;
};
exports.fieldEscape = fieldEscape;

View on GitHub (pinned to 5ebe8903d6)

Solutions

1. Alias the offending column in the query: `SELECT __proto__ AS proto_val FROM t`.
2. Rename the column in the schema to a non-reserved name.
3. Use `rowsAsArray: true` to receive rows as arrays instead of objects, avoiding property assignment entirely.

Example fix

// before
connection.query('SELECT __proto__ FROM t');

// after
connection.query('SELECT __proto__ AS proto_val FROM t');

const privateObjectProps = new Set(['__proto__','__defineGetter__','__defineSetter__','__lookupGetter__','__lookupSetter__']);
function assertSafeFieldNames(fields) {
  fields.forEach((f) => {
    if (privateObjectProps.has(f)) throw new Error(`Field '${f}' collides with an object prototype property; alias it in SQL.`);
  });
}

function isSafeFieldName(name) {
  return !privateObjectProps.has(name);
}

When it happens

Trigger: A MySQL table whose column name (or a nestTables field name) is literally one of those reserved prototype property strings, e.g. `SELECT __proto__ FROM t`. Also reachable when rowsAsArray/nestTables is used and a field name matches the blocklist.

Common situations: A schema with a column named `__proto__` (rare but possible); generated/migrated schemas with dunder column names; using `nestTables` where a table name collides.

AI-assisted analysis of sidorares/node-mysql2@5ebe8903d6 (2026-08-03). Data as JSON: /data/errors/d429942e5365e626.json. Report an issue: GitHub.