AIKIDO-2026-10944

TL;DR

The spawnAsync helper buffers child stdout and stderr into in-memory strings while a subprocess runs. Before the fix, each chunk was appended without a byte limit, so a child that prints very large or continuous output could grow unbounded buffers in the parent process. That can exhaust memory or exceed V8 maximum string length and crash the host Node application. The fix collects output in a bounded sliding window, enforces an optional maxBuffer limit with ERR_CHILD_PROCESS_STDIO_MAXBUFFER, and applies a default cap tied to MAX_STRING_LENGTH with lazy stdout and stderr accessors.