Security: bson-objectid@2.0.4 has unpatched vulnerability (SNYK-JS-BSONOBJECTID-570765 / CVE-2019-19729)

Summary

bson-objectid@2.0.4 is a transitive dependency of payload, @payloadcms/next, and @payloadcms/richtext-lexical. It has an unpatched prototype pollution vulnerability with no fix available from the upstream maintainer.

Vulnerability details

• Snyk ID: SNYK-JS-BSONOBJECTID-570765
• CVE: CVE-2019-19729
• Package: bson-objectid@2.0.4
• Type: Prototype Pollution
• Fix available: No — the bson-objectid package appears unmaintained and has not released a patched version

Dependency path

payload@3.84.1 → bson-objectid@2.0.4
@payloadcms/next@3.84.1 → @payloadcms/ui@3.84.1 → bson-objectid@2.0.4
@payloadcms/richtext-lexical@3.84.1 → bson-objectid@2.0.4

Request

Since no patched version of bson-objectid exists, could Payload consider replacing it with the actively maintained bson package (from MongoDB) or another alternative for ObjectID generation? This would resolve the security finding for all downstream users.