AIKIDO-2026-519041

TL;DR

The deserialize function reconstructs values by calling new globalThis[name](message) and new globalThis[type](value), where the constructor name comes from the serialized input. When an application passes attacker-controlled serialized data to deserialize or parse, an attacker can request constructors such as Function and obtain a live function from the payload (new Function(message)), enabling code execution when that value is later invoked. Other globals could also be abused for denial of service or unexpected side effects. The patch restricts deserialization to allow-lists of safe Error subclasses and typed-array / primitive wrappers.