AIKIDO-2026-186548
napi is vulnerable to Use After Free
81
High Risk
This Affects:
napiTL;DR
ArrayBuffer::from_external, the TypedArraySlice::from_external variants, Uint8ClampedSlice::from_external, and the deprecated Env::create_arraybuffer_with_borrowed_data copy caller bytes into an engine-owned buffer on runtimes that reject external buffers, then run the finalize callback that frees the source before returning a slice that still points at the freed source memory. Rust code reading the slice accesses freed memory and writes corrupt live allocations. Heap state shaped from JavaScript controls the contents of the freed region. The fix points the returned slice at the engine-owned copy after finalize runs.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your add-on runs on a JavaScript engine that prohibits external buffers, such as Electron or a sandboxed V8 build.
Background info
napi is vulnerable to Use After Free in versions 2.10.13 - 3.12.3.
How to fix this
Upgrade the napi library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.