AIKIDO-2026-270573

TL;DR

lib0's binary decoder readUint8Array builds a Uint8Array view sized directly from a peer-supplied length prefix, without checking it against the bytes remaining in the decoder's buffer. Because small Node Buffers are views into a shared 64 KiB allocation slab, an over-long length returns whatever adjacent data the process allocated next, including other connections' messages, tenant data, or session tokens. readVarUint8Array and readVarString inherit the same missing check. The fix rejects negative or out-of-range lengths before constructing the view.