AIKIDO-2026-62408
napi is vulnerable to Type Confusion
81
High Risk
This Affects:
napiTL;DR
The AbortSignal::from_napi_value conversion casts any JavaScript object to an AbortSignalStack without validating its type. When a native addon accepts an AbortSignal, untrusted JavaScript can pass an arbitrary wrapped object, causing the recovered pointer to be reinterpreted with the wrong memory layout. This enables memory writes through pointers derived from the object and can free the victim object with an incorrect layout after its finalizer is stripped. The fix validates the payload against a type registry before casting.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your native addon accepts an AbortSignal argument that can be supplied by untrusted JavaScript.
Background info
napi is vulnerable to Type Confusion in versions 3.0.0 - 3.12.1.
How to fix this
Upgrade the napi library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant