AIKIDO-2026-994514

TL;DR

The napi crate mishandles finalize callbacks for N-API class Reference values and external Latin-1/UTF-16 strings. Allocating finalize state with Rc while GC teardown reinterprets the same pointer as Arc causes undefined behavior and can abort the Node process under class reference churn. On WASI and similar targets, external string helpers could double-free or use freed buffers when V8 or emnapi copies string data synchronously. Version 3.9.1 unifies finalize callbacks on Arc and reworks external string ownership so buffers stay valid and finalizers run once.