CVE-2022-46164: NodeBB vulnerable to account takeover via prototype vulnerability

The vulnerability stems from the initialization of the 'Namespaces' object as a plain object with a prototype ({}). The commit fixes this by using Object.create(null), which creates a prototype-less object. The associated CWE-665 (Improper Initialization) and the patch's focus on socket.io's onMessage handling confirm that the message handler relied on this vulnerable object. Prototype pollution in this context allows attackers to inject malicious properties into the Namespaces object, leading to authentication bypass.