AIKIDO-2025-10614

TL;DR

Affected versions of this package are vulnerable to a Use-After-Free (UaF) via a Dangling Reference to a Temporary. The vulnerability arises because a constant kj::HashSet<kj::String> object EMPTY_HANDLERS is not defined as a static within a function scope, causing its destructor to run when the function exits and leaving a global reference pointing to freed memory. An attacker can exploit this by manipulating the program's flow to trigger the use of this dangling reference, potentially leading to information disclosure, a crash, or arbitrary code execution depending on how the corrupted memory is accessed.