AIKIDO-2026-538487
mini_racer is vulnerable to Denial of Service (DoS)
63
Medium Risk
This Affects:
mini_racerTL;DR
The mini_racer C extension forwards Ruby callback exception messages to V8 using C-string APIs that truncate at embedded NUL bytes, which can permanently deadlock a MiniRacer::Context. Affected versions also failed to free native buffers after heap_snapshot and write_heap_snapshot, allowing host memory to grow with repeated use. The patch switches to length-aware string handling, releases snapshot buffers after serialization, and rejects unsafe V8 flags containing NUL bytes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
mini_racer is vulnerable to Denial of Service (DoS) in versions 0.18.0 - 0.21.1.
How to fix this
Upgrade the mini_racer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant