AIKIDO-2026-10345

TL;DR

Affected versions of this package are affected by a use after free vulnerability in workerd. Under certain conditions, asynchronous request handling paths may retain references to objects associated with request or stream processing after those objects have already been released. This can result in memory safety violations when the stale references are later accessed. An attacker able to trigger these conditions through crafted requests could cause the worker runtime to access freed memory, potentially leading to crashes and denial-of-service. The issue is fixed by improving lifecycle management and ensuring that internal objects cannot be accessed after they have been invalidated.