From the issue:

On https://github.com/mongodb/js-bson/blob/master/lib/objectid.js#L87 you allow creating an ObjectId with a string of length 12, which then gets set to this.id – but on https://github.com/mongodb/js-bson/blob/master/lib/objectid.js#L253 it assumes that this.id is a Buffer.

I cannot find anywhere in the code where that would be sanitized; my guess is it doesn't come up much, but that should probably be clarified one way or the other.

—

There are actually several other places in the file which will die a gruesome death if you use a 12 byte string for this.id

Another item from the same file which isn't really a big deal but could be fixed: const decodeLookup should be {} not [] since you're not using it as an array, rather as a dict / map. (the array when you're done currently is not going to have the correct length as it is)