AIKIDO-2026-10559

TL;DR

The Web Streams BYOB path could call user-defined size logic in ways that let re-entrancy and bad readAtLeast bounds stress or break the implementation, and there was a gap where transforms could use controller state after a callback had already errored. Several hot paths used memcpy on regions that the standard allows to overlap, which is undefined behavior in C++ and can corrupt memory compared with memmove. The I/O ExternalPusher path could assume ordering in a way that was unsafe when messages arrived out of order, and the update restructures that flow. These changes harden the runtime that backs the versioned workerd npm distribution.