AIKIDO-2026-10028

TL;DR

Affected versions of the package may expose uninitialized memory due to a flaw in Node.js buffer allocation when allocations are interrupted while using the vm module with the timeout option. Under specific timing conditions, buffers created via Buffer.alloc or TypedArray instances such as Uint8Array may contain residual data from previous operations, potentially leaking in-process secrets like tokens or passwords or causing data corruption.