AIKIDO-2026-869882

TL;DR

The parse function reconstructs a value graph from a flat array of nodes that reference one another by numeric index. When parsing untrusted input, the code dereferences those indices without checking that they fall inside the parsed values array, so a crafted payload can reference out-of-bounds indices and force the parser to repeatedly switch between different array representations. This makes the parsing work grow quadratically with the payload size, so a small malicious string can hang the process and deny service. The fix validates each index against the values array length and throws Invalid input for any index that is out of range.