AIKIDO-2026-10724

TL;DR

Guest code can call Buffer.alloc with extremely large sizes and pressure host heap without hitting the same throttling patterns as network-bound work. That yields a memory exhaustion denial of service against the embedding process. The behavior is especially risky when operators assume timeouts protect them from huge allocations. A new bufferAllocLimit option lets embedders cap individual allocations as defense in depth.