AIKIDO-2026-68991

TL;DR

Affected versions of viperjs panic when dividing by a BigInt whose magnitude lands exactly on the engine's internal limb ceiling. During normalisation, a left-shift that needs one limb past MAX_LIMBS is refused and then discarded with unwrap_or_default, leaving an empty divisor; indexing divisor[n - 1] then panics. The same root cause also returns wrong results without error: remainder can report 0n instead of the true value, and String() of such a magnitude yields "0". Because viperjs is intended to evaluate untrusted script, a short piece of source can crash the embedder's process. Version 0.2.2 fixes the shift bounds, propagates size refusals as RangeError, and makes oversized digit conversion throw rather than answer incorrectly.