Request validation bypass via plain-object assignment

Improper input validation in Frourio frourio-express before 0.26.0 allows remote attackers to bypass request validation via crafted input. The generated Express validation handlers pass request bodies and queries to class-validator after Object.assign creates only the outer class instance, so nested values remain plain objects whose decorators are not enforced. Exposure requires an application built before 0.26.0 that uses the validators directory; accepted malformed fields then reach controller logic without the intended checks.