fix: make config deep-freeze truly recursive for all nesting levels

getConfigOptions() only froze the first level of nested plain
objects (e.g., customNested was frozen but customNested.nested
was still mutable). Replaced Object.freeze() with a recursive
deepFreezePlain() that walks all depths, matching the documented
'deep freeze' behavior.

Author: jkyberneees

index.js

@@ -13,6 +13,20 @@ const exts = {
   response: require('./libs/response-extensions')
 }
 
+/**
+ * Recursively freezes a plain object and all nested plain objects.
+ * Skips arrays, Buffers, class instances, and other non-plain types.
+ */
+function deepFreezePlain (obj) {
+  if (obj && typeof obj === 'object' && obj.constructor === Object && !Object.isFrozen(obj)) {
+    Object.freeze(obj)
+    for (const key of Object.keys(obj)) {
+      deepFreezePlain(obj[key])
+    }
+  }
+  return obj
+}
+
 module.exports = (options = {}) => {
   options.errorHandler =
     options.errorHandler ||
@@ -62,13 +76,13 @@ module.exports = (options = {}) => {
 
     getConfigOptions () {
       const copy = { ...options }
-      // Deep-clone + freeze nested plain objects so the user's originals
+      // Deep-clone + deep-freeze nested plain objects so the user's originals
       // are not mutated as a side effect of calling getConfigOptions().
       for (const key of Object.keys(copy)) {
         const val = copy[key]
         if (val && typeof val === 'object' && !Array.isArray(val) &&
             key !== 'server' && val.constructor === Object) {
-          copy[key] = Object.freeze(JSON.parse(JSON.stringify(val)))
+          copy[key] = deepFreezePlain(JSON.parse(JSON.stringify(val)))
         }
       }
       return Object.freeze(copy)

specs/security-review-2026.test.js

@@ -398,29 +398,35 @@ describe('Security Review — April 2026', () => {
       expect(opts.server).to.equal(service.getServer())
     })
 
-    it('should freeze nested plain objects in config options', () => {
+    it('should freeze nested plain objects in config options (all depths)', () => {
       const service = require('../index')({
-        customNested: { key: 'value', nested: { inner: 'secret' } }
+        customNested: { key: 'value', nested: { inner: 'secret', deeper: { deepest: true } } }
       })
       const opts = service.getConfigOptions()
 
-      // Nested plain objects should be frozen
+      // First level
       expect(Object.isFrozen(opts.customNested)).to.equal(true)
+      // Second level
+      expect(Object.isFrozen(opts.customNested.nested)).to.equal(true)
+      // Third level
+      expect(Object.isFrozen(opts.customNested.nested.deeper)).to.equal(true)
     })
 
     it('should NOT freeze user-provided original nested objects (no side effects)', () => {
-      const myConfig = { key: 'value', nested: { inner: 'secret' } }
+      const myConfig = { key: 'value', nested: { inner: 'secret', deeper: { deepest: true } } }
       const service = require('../index')({
         customNested: myConfig
       })
 
-      // Read config — this should NOT freeze the original
+      // Read config — this should NOT freeze the original at any depth
       service.getConfigOptions()
 
-      // The user's original object must remain mutable
       expect(Object.isFrozen(myConfig)).to.equal(false)
+      expect(Object.isFrozen(myConfig.nested)).to.equal(false)
+      expect(Object.isFrozen(myConfig.nested.deeper)).to.equal(false)
       expect(() => { myConfig.key = 'updated' }).to.not.throw()
       expect(() => { myConfig.nested.inner = 'changed' }).to.not.throw()
+      expect(() => { myConfig.nested.deeper.deepest = false }).to.not.throw()
     })
 
     it('should prevent mutation of top-level config properties', () => {