AIKIDO-2026-505358

TL;DR

stringify, stringifyAsync, and uneval serialize a typed array or Node Buffer by copying its full backing ArrayBuffer instead of only the bytes the view exposes. A Node Buffer's backing store is Node's shared allocation pool for the whole process, so serializing even a small Buffer copies unrelated bytes from other requests into the output. In an SSR framework, a page whose load() returns a small Buffer or a small file read can leak another request's body or Authorization header into its rendered HTML. The fix copies only the visible bytes into a fresh buffer before serializing.