AIKIDO-2026-538487
mini_racer is vulnerable to Denial of Service (DoS)
63
Medium Risk
This Affects:
mini_racerTL;DR
The mini_racer C extension forwards Ruby callback exception messages to V8 using C-string APIs that truncate at embedded NUL bytes, which can permanently deadlock a MiniRacer::Context. Affected versions also failed to free native buffers after heap_snapshot and write_heap_snapshot, allowing host memory to grow with repeated use. The patch switches to length-aware string handling, releases snapshot buffers after serialization, and rejects unsafe V8 flags containing NUL bytes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
mini_racer is vulnerable to Denial of Service (DoS) in versions 0.18.0 - 0.21.1.
How to fix this
Upgrade the mini_racer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.