From b546a88a8b1113a6f6ddf1a2a25faf37f17dfbe5 Mon Sep 17 00:00:00 2001
From: LiviaMedeiros <livia@cirno.name>
Date: Sat, 24 Oct 2026 13:06:50 +0800
Subject: [PATCH 1/2] util: use internal `hexSlice` directly in
 `util.inspect()`

Signed-off-by: LiviaMedeiros <livia@cirno.name>
---
 lib/internal/buffer.js       | 1 +
 lib/internal/util/inspect.js | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/internal/buffer.js b/lib/internal/buffer.js
index 325df6ca01ad..3f99fe6d161a 100644
--- a/lib/internal/buffer.js
+++ b/lib/internal/buffer.js
@@ -1148,6 +1148,7 @@ module.exports = {
   createUnsafeAlignedBuffer,
   readUInt16BE,
   readUInt32BE,
+  hexSlice,
   asciiWrite,
   latin1Write,
   utf8Write,
diff --git a/lib/internal/util/inspect.js b/lib/internal/util/inspect.js
index 3d36c5793bea..7ee103196585 100644
--- a/lib/internal/util/inspect.js
+++ b/lib/internal/util/inspect.js
@@ -130,7 +130,6 @@ const {
   WeakSet,
   WeakSetPrototype,
   globalThis,
-  uncurryThis,
 } = primordials;
 
 const {
@@ -195,7 +194,10 @@ const {
   kValidateObjectAllowArray,
 } = require('internal/validators');
 
-let hexSlice;
+const {
+  hexSlice,
+} = require('internal/buffer');
+
 let internalUrl;
 
 function pathToFileUrlHref(filepath) {
@@ -2347,8 +2349,6 @@ function formatArrayBuffer(ctx, value) {
   } catch {
     return [ctx.stylize('(detached)', 'special')];
   }
-  if (hexSlice === undefined)
-    hexSlice = uncurryThis(require('buffer').Buffer.prototype.hexSlice);
   const rawString = hexSlice(buffer, 0, MathMin(ctx.maxArrayLength, buffer.length));
   let str = '';
   let i = 0;

From 7049c3801c35674e7835d5417527963a2ccb31aa Mon Sep 17 00:00:00 2001
From: LiviaMedeiros <livia@cirno.name>
Date: Sat, 24 Oct 2026 13:08:05 +0800
Subject: [PATCH 2/2] squash: add test

Signed-off-by: LiviaMedeiros <livia@cirno.name>
---
 .../parallel/test-util-inspect-prototype-pollution.mjs | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 test/parallel/test-util-inspect-prototype-pollution.mjs

diff --git a/test/parallel/test-util-inspect-prototype-pollution.mjs b/test/parallel/test-util-inspect-prototype-pollution.mjs
new file mode 100644
index 000000000000..40b6ad4a7dc5
--- /dev/null
+++ b/test/parallel/test-util-inspect-prototype-pollution.mjs
@@ -0,0 +1,10 @@
+import { mustNotCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import { inspect } from 'node:util';
+
+// util.inspect must not be affected by userland mutations of Buffer.prototype
+Buffer.prototype.hexSlice = mustNotCall();
+
+const { buffer } = new Uint8Array([0x04, 0x38, 0x73, 0xE6]);
+const expected = 'ArrayBuffer { [Uint8Contents]: <04 38 73 e6>, [byteLength]: 4 }';
+assert.strictEqual(inspect(buffer), expected);