A native extension is add-on code written in a low-level language such as C or C++ that is loaded by a higher-level runtime like Ruby, Python, or Node.js. The runtime exposes an interface so the extension can do work faster or access system features that pure language code cannot easily reach.
In cyber security, native extensions matter because they run with the same trust as the application, but they are much easier to break with memory bugs. If an extension parses attacker-controlled input, a flaw can lead to crashes, data leaks, or remote code execution instead of a simple application error. Defenders treat native extensions as part of the attack surface: they track versions, limit exposure of parsing features, sandbox risky services, and prefer memory-safe libraries when possible.