CVE-2026-39865: Array Splice Missing Unconditional Return In Backward While Loopcve-2026-39865-array-splice-missing-unconditional-return-in-backward-while-loop
Array.splice() is called inside a backward-decrement while loop but the enclosing block only returns conditionally (inside a nested if) after removal. When the condition is false the loop continues iterating over the now-shorter array with stale index bounds, causing state corruption that can crash the process or corrupt shared state under concurrent access
