"mergeIncrementalResult" merges an incremental GraphQL response part into an accumulated execution result by walking "['data', ...incrementalResult.path]" and assigning at the resolved location. "setObjectKeyPath" tries to reject dangerous segments with strict string equality against "'__proto__'", "'constructor'" and "'prototype'" (lines 50-52 and 60-62), but it never validates that a path segment is a primitive string or number. A JSON path segment such as "["__proto__"]" is an array object, so "["__proto__"] !== '__proto__'" and the guard passes; the very next statement does "current[key]", whose "ToPropertyKey" coercion turns that array into the string key ""__proto__"" and resolves "Object.prototype". The following, innocuous-looking segment is then assigned directly onto "Object.prototype". In a consuming app, "incrementalResult" is the response part being merged — data parsed from an upstream "@defer"/"@stream" multipart or incremental-delivery response from another GraphQL server or transport. The "ExecutionResult" TypeScript annotation is not a runtime check, so a malicious, compromised, or MITM'd upstream can choose the "path" value and therefore choose global prototype keys and values in the gateway or client process. Comparable paths through the same helper, for contrast: - Plain string segment ""__proto__"" -> blocked by strict equality, lines 50-52 (confirmed by a control case in testing) - Array segment "["__proto__"]" -> unsafe: passes the guard at lines 50-52, then coerced to the "__proto__" key at lines 53-57 - Same operation in 10.10.0 and earlier, which used "dset" -> not exploitable (0/5 attack payloads succeeded)