AIKIDO-2026-600355
napi is vulnerable to Out-of-bounds Write
81
High Risk
This Affects:
napiTL;DR
BufferSlice::from_data, BufferSlice::copy_from, and BufferSlice::from_external build their Deref/DerefMut slice from the napi_value handle out-parameter instead of the buffer's data pointer. Reading the slice exposes V8 handle-scope addresses and adjacent memory, and writing through it overwrites handle-scope slots with JavaScript-controlled bytes and length. Ordinary add-on code that allocates buffers of JavaScript-supplied sizes triggers this without special preconditions. The fix reads the real buffer pointer via napi_get_buffer_info before constructing the slice.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
napi is vulnerable to Out-of-bounds Write in versions 3.0.0 - 3.12.2.
How to fix this
Upgrade the napi library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.