AIKIDO-2026-10392

TL;DR

The internal sort() in index.js used recursive quicksort to build the spatial index. On degenerate input (e.g. large sets of duplicate coordinates), partition imbalance can cause recursion depth to grow linearly, hitting the engine's stack limit and throwing a "max recursion depth" (or similar) error and crashing the process. An attacker who can supply or influence the data passed to index.add() and then trigger index.finish() can cause denial of service. The fix replaces the recursive implementation with an iterative quicksort that uses an explicit stack, bounding stack depth and preventing overflow.