AIKIDO-2026-309198
napi is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
napiTL;DR
The serde Deserializer used by Env::from_js_value treats several ordinary JavaScript value types as impossible cases and calls unreachable!() instead of returning an error. A BigInt on non-napi6 builds reaches deserialize_any, and non-object values reach deserialize_bytes/deserialize_byte_buf, firing the panic. The panic cannot unwind across the N-API extern "C" boundary, so the process aborts with SIGABRT and terminates Node instead of surfacing a catchable error. The fix returns InvalidArg deserialization errors for these shapes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your add-on deserializes untrusted JavaScript values through the serde integration.
Background info
napi is vulnerable to Denial of Service (DoS) in versions 2.0.0 - 3.12.3.
How to fix this
Upgrade the napi library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.