AIKIDO-2026-875097
es-module-lexer is vulnerable to Out-of-bounds Write
36
Low Risk
This Affects:
es-module-lexerTL;DR
es-module-lexer lexes ES module syntax with fixed size C parser stacks compiled to WebAssembly and asm.js: a 1024-entry open token stack and a 512-entry dynamic import stack. Source that nests more open tokens (parentheses, brackets, braces, templates) or dynamic imports than those limits keeps pushing without any depth check and writes past the end of the fixed stack arrays. These out-of-bounds writes corrupt adjacent parser memory and can crash the parse or return corrupted results on crafted source. The fix adds depth guards that stop at the limits and raise a parse error.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you lex untrusted or externally influenced source.
Background info
es-module-lexer is vulnerable to Out-of-bounds Write in versions 0.3.0 - 2.3.2.
How to fix this
Upgrade the es-module-lexer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.