AIKIDO-2026-96856

TL;DR

The experimental Node.js HTTP adapter's readRequestBody() reads an incoming request body into a plain string and appends every decoded chunk with no byte counter or content length check. A single large POST request to createNodeHttpHandler() is fully buffered in memory before any ACP level validation or content type check. No authentication, valid session, or well formed JSON-RPC payload is required, so the request alone can exhaust the Node process heap and crash it. The fix bounds incoming reads so an oversized body is rejected instead of fully buffered.