Part 1.2 of NODE-7598

What: new Binary(Buffer.alloc(0), Binary.SUBTYPE_VECTOR) produces a subtype-9 (Vector) value with no dtype/padding metadata, yet both BSON.serialize and EJSON.stringify emit it without complaint. A one-byte vector is correctly rejected, so this is specifically a missing minimum-length invariant, not a fully disabled validator.

Root cause: validateBinaryVector in src/binary.ts reads vector.buffer[0] (dtype) and vector.buffer[1] (padding) without first checking that those two bytes exist. With a zero-length payload both reads are undefined, so every dtype-specific branch is skipped and validation passes. The typed helper constructors (fromInt8Array, etc.) always allocate byteLength + 2, so the invariant is "every subtype-9 value carries 2 metadata bytes" — just not enforced on the raw constructor path.

Conditions required: an application must wrap caller-controlled bytes in the raw Binary(buf, SUBTYPE_VECTOR) constructor (rather than the typed helpers) and then treat js-bson serialization as its validation boundary before persisting/exporting. The impact is integrity (malformed vector data emitted), not memory safety or a server-side acceptance claim.

Pinned ref: 5b42c5a1535d45ec89ab9f1ed3bb249d09730e3c

Details & PoC: int-mongodb-js-bson-empty-vector-serialization-bypass/README.md and int-mongodb-js-bson-empty-vector-serialization-bypass/poc/ (run bash poc/run.sh).

Suggested fix: Reject subtype-9 Binary with fewer than 2 bytes in validateBinaryVector.

Use Case

As a... bson user
I want... serialization to guard against malformed bson
So that... I avoid undefined behaviors

User Experience

• What is the desired/expected outcome for the user once this ticket is implemented?
  • validateBinaryVector in the js-bson library confirms bytes exist before it tries to read from them; specifically that at least two bytes exist before trying to serialize a Binary object with subtype vector
• If bug: What is the number of impacted customers? How severe is the impact? Is anyone blocked or broken?

Dependencies

Risks/Unknowns

Acceptance Criteria

Implementation Requirements

Testing Requirements

• add unit tests to confirm this edge case

Documentation Requirements

Follow Up Requirements

• additional tickets to file, required releases, etc
• if node behavior differs/will differ from other drivers, confirm with dbx devs what standard to aim for and what plan, if any, exists to reconcile the diverging behavior moving forward