no-unsafe-alloc

Disallow unsafe uninitialized buffer allocation APIs in Node.js.

Targeted pattern scope

This rule targets:

• Buffer.allocUnsafe(...)
• Buffer.allocUnsafeSlow(...).

What this rule reports

This rule reports calls to unsafe buffer constructors that may expose stale memory data.

Why this rule exists

Unsafe buffer allocation can leak sensitive process memory contents if buffers are consumed before full initialization.

❌ Incorrect

const payload = Buffer.allocUnsafe(64);

✅ Correct

const payload = Buffer.alloc(64);

ESLint flat config example

import sdl from "eslint-plugin-sdl-2";

export default [
 {
  plugins: { sdl },
  rules: {
   "sdl/no-unsafe-alloc": "error",
  },
 },
];

When not to use it

Disable only for profiled performance hotspots that guarantee complete buffer initialization before use.

Package documentation

• Rule source

Further reading

Rule catalog ID: R025

• Node.js buffer security note