You would need to share the codebase that generates the error so that we can tell you what is wrong with your code.
With the log you shared it is clear that the code and data you shared does not the generate the error you mentioned, unless something was redacted. In particular, I am really surprised that the keyword new also appears in the console.log output. That differs from the output I am used to like
Note that the string 66ed…225a is a valid string to convert to an object id. But if your real code is like the one you share, where it seems you take data received from the web (userId) without any kind of validation, and then feed it to your API then it is destined to fail.
Trying to fix this by switching infrastructure like
won’t really fix the issue.
In situation like that we usually sanitize the input or try-catch to make sure we do not feed bad data to the other layers. Hackers will always try to feed you app with bad data, so you have to make sure it does not break your code.