AIKIDO-2026-10246

TL;DR

Affected versions of this package are affected by a use-after-free vulnerability in the async generator implementation. The issue occurs because the originating instance can be garbage collected while an async iterator is still in use, causing the iterator to reference freed memory and potentially leading to crashes. This happens when no persistent reference is maintained between the generated iterator and its underlying instance during for await...of iteration. The vulnerability is fixed by keeping the instance alive through a hidden internal reference attached to the iterator object, which is properly released once the iterator is garbage collected.