AIKIDO-2026-646955

TL;DR

emnapi's Node-API bridge functions napi_get_arraybuffer_info, napi_get_typedarray_info, and napi_get_buffer_info read the metadata (byteLength, length, byteOffset, buffer) of a caller-supplied buffer or typed array through direct property access and instanceof checks. A JavaScript object crafted to look like a typed array or ArrayBuffer can override these own properties or accessors to report a byteLength or length larger than its actual backing memory, so a native addon that trusts the returned metadata for a raw memory copy can read or write past the real buffer bounds. The fix reads buffer and view metadata through cached intrinsic prototype getters and ArrayBuffer.isView/Symbol.toStringTag checks instead of the object's own accessors, so spoofed own properties can no longer influence the returned size or pointer.