AIKIDO-2026-540380

TL;DR

The fromRlp utility in viem decodes Recursive-Length Prefix (RLP) payloads by recursively walking each nested list through fromRlpCursor and readList. Before the fix this recursion had no depth limit, so an RLP payload built from many nested lists drives the decoder into unbounded recursion. Decoding untrusted RLP data such as serialized transactions or network responses can therefore exhaust the call stack and crash the decode operation or the surrounding process. The fix caps RLP decoding at a depth of 1024 and throws RlpDepthLimitExceededError once that limit is reached.