AIKIDO-2025-10577

TL;DR

Affected versions of this package are vulnerable to Denial of Service (DoS) due to improper tracking of expression nesting depth when parsing function declarations. An attacker can exploit this by crafting malicious JavaScript code containing excessively nested expressions within a function body, causing the parser to consume excessive resources (e.g., stack overflow), resulting in application crashes or hangs. This occurs because the parser fails to enforce nesting limits during function body parsing, allowing catastrophic backtracking or recursion.