fix: deep-clone nested config before freezing to avoid side effects

getConfigOptions() was freezing nested plain objects in place
via Object.freeze(val), which also froze the user's original
objects since the spread copy is shallow. Now deep-clones
with JSON.parse(JSON.stringify()) before freezing, so the
returned config is immutable but the caller's originals
remain mutable.

Author: jkyberneees

index.js

@@ -62,12 +62,13 @@ module.exports = (options = {}) => {
 
     getConfigOptions () {
       const copy = { ...options }
-      // Deep-freeze nested plain objects (server is a live reference — exempted)
+      // Deep-clone + freeze nested plain objects so the user's originals
+      // are not mutated as a side effect of calling getConfigOptions().
       for (const key of Object.keys(copy)) {
         const val = copy[key]
         if (val && typeof val === 'object' && !Array.isArray(val) &&
             key !== 'server' && val.constructor === Object) {
-          Object.freeze(val)
+          copy[key] = Object.freeze(JSON.parse(JSON.stringify(val)))
         }
       }
       return Object.freeze(copy)

specs/security-review-2026.test.js

@@ -408,6 +408,21 @@ describe('Security Review — April 2026', () => {
       expect(Object.isFrozen(opts.customNested)).to.equal(true)
     })
 
+    it('should NOT freeze user-provided original nested objects (no side effects)', () => {
+      const myConfig = { key: 'value', nested: { inner: 'secret' } }
+      const service = require('../index')({
+        customNested: myConfig
+      })
+
+      // Read config — this should NOT freeze the original
+      service.getConfigOptions()
+
+      // The user's original object must remain mutable
+      expect(Object.isFrozen(myConfig)).to.equal(false)
+      expect(() => { myConfig.key = 'updated' }).to.not.throw()
+      expect(() => { myConfig.nested.inner = 'changed' }).to.not.throw()
+    })
+
     it('should prevent mutation of top-level config properties', () => {
       const service = require('../index')()
       const opts = service.getConfigOptions()