diff --git a/server/package-lock.json b/server/package-lock.json
index 05ff21437..b152c83da 100644
--- a/server/package-lock.json
+++ b/server/package-lock.json
@@ -1,18 +1,18 @@
 {
   "name": "@scrypted/server",
-  "version": "0.121.1",
+  "version": "0.121.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@scrypted/server",
-      "version": "0.121.1",
+      "version": "0.121.0",
       "hasInstallScript": true,
       "license": "ISC",
       "dependencies": {
         "@scrypted/ffmpeg-static": "^6.1.0-build1",
         "@scrypted/node-pty": "^1.0.18",
-        "@scrypted/types": "^0.3.62",
+        "@scrypted/types": "^0.3.63",
         "adm-zip": "^0.5.16",
         "body-parser": "^1.20.3",
         "cookie-parser": "^1.4.7",
@@ -40,13 +40,13 @@
         "scrypted-serve": "bin/scrypted-serve"
       },
       "devDependencies": {
-        "@types/adm-zip": "^0.5.5",
+        "@types/adm-zip": "^0.5.6",
         "@types/cookie-parser": "^1.4.7",
         "@types/express": "^5.0.0",
         "@types/follow-redirects": "^1.14.4",
         "@types/http-auth": "^4.1.4",
-        "@types/lodash": "^4.17.10",
-        "@types/node": "^22.7.6",
+        "@types/lodash": "^4.17.12",
+        "@types/node": "^22.8.4",
         "@types/node-dijkstra": "^2.5.6",
         "@types/node-forge": "^1.3.11",
         "@types/semver": "^7.5.8",
@@ -557,14 +557,14 @@
       }
     },
     "node_modules/@scrypted/types": {
-      "version": "0.3.62",
-      "resolved": "https://registry.npmjs.org/@scrypted/types/-/types-0.3.62.tgz",
-      "integrity": "sha512-tJHpCS8B0K7h33plkbajOAHUfOpqrEJOwYAojdOTc/DGf6+xKOUMKXl+wnEHmtjtUmlSNjeBQJxJ8ua813gS6Q=="
+      "version": "0.3.63",
+      "resolved": "https://registry.npmjs.org/@scrypted/types/-/types-0.3.63.tgz",
+      "integrity": "sha512-9oYF/tsSXl5v9uOjuoRZvzn6drpMSw+5sspOlBM6OfT91HewCHR2IgQV/h7lSwQK1xzXkdbuyJI1Rsp0Z/cl2A=="
     },
     "node_modules/@types/adm-zip": {
-      "version": "0.5.5",
-      "resolved": "https://registry.npmjs.org/@types/adm-zip/-/adm-zip-0.5.5.tgz",
-      "integrity": "sha512-YCGstVMjc4LTY5uK9/obvxBya93axZOVOyf2GSUulADzmLhYE45u2nAssCs/fWBs1Ifq5Vat75JTPwd5XZoPJw==",
+      "version": "0.5.6",
+      "resolved": "https://registry.npmjs.org/@types/adm-zip/-/adm-zip-0.5.6.tgz",
+      "integrity": "sha512-lRlcSLg5Yoo7C2H2AUiAoYlvifWoCx/se7iUNiCBTfEVVYFVn+Tr9ZGed4K73tYgLe9O4PjdJvbxlkdAOx/qiw==",
       "dev": true,
       "dependencies": {
         "@types/node": "*"
@@ -654,9 +654,9 @@
       }
     },
     "node_modules/@types/lodash": {
-      "version": "4.17.10",
-      "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.17.10.tgz",
-      "integrity": "sha512-YpS0zzoduEhuOWjAotS6A5AVCva7X4lVlYLF0FYHAY9sdraBfnatttHItlWeZdGhuEkf+OzMNg2ZYAx8t+52uQ==",
+      "version": "4.17.12",
+      "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.17.12.tgz",
+      "integrity": "sha512-sviUmCE8AYdaF/KIHLDJBQgeYzPBI0vf/17NaYehBJfYD1j6/L95Slh07NlyK2iNyBNaEkb3En2jRt+a8y3xZQ==",
       "dev": true
     },
     "node_modules/@types/mime": {
@@ -666,11 +666,11 @@
       "dev": true
     },
     "node_modules/@types/node": {
-      "version": "22.7.6",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.7.6.tgz",
-      "integrity": "sha512-/d7Rnj0/ExXDMcioS78/kf1lMzYk4BZV8MZGTBKzTGZ6/406ukkbYlIsZmMPhcR5KlkunDHQLrtAVmSq7r+mSw==",
+      "version": "22.8.4",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.8.4.tgz",
+      "integrity": "sha512-SpNNxkftTJOPk0oN+y2bIqurEXHTA2AOZ3EJDDKeJ5VzkvvORSvmQXGQarcOzWV1ac7DCaPBEdMDxBsM+d8jWw==",
       "dependencies": {
-        "undici-types": "~6.19.2"
+        "undici-types": "~6.19.8"
       }
     },
     "node_modules/@types/node-dijkstra": {
diff --git a/server/package.json b/server/package.json
index df75a430a..b59b07cda 100644
--- a/server/package.json
+++ b/server/package.json
@@ -1,11 +1,11 @@
 {
   "name": "@scrypted/server",
-  "version": "0.120.0",
+  "version": "0.121.3",
   "description": "",
   "dependencies": {
     "@scrypted/ffmpeg-static": "^6.1.0-build1",
     "@scrypted/node-pty": "^1.0.18",
-    "@scrypted/types": "^0.3.62",
+    "@scrypted/types": "^0.3.63",
     "adm-zip": "^0.5.16",
     "body-parser": "^1.20.3",
     "cookie-parser": "^1.4.7",
@@ -30,13 +30,13 @@
     "ws": "^8.18.0"
   },
   "devDependencies": {
-    "@types/adm-zip": "^0.5.5",
+    "@types/adm-zip": "^0.5.6",
     "@types/cookie-parser": "^1.4.7",
     "@types/express": "^5.0.0",
     "@types/follow-redirects": "^1.14.4",
     "@types/http-auth": "^4.1.4",
-    "@types/lodash": "^4.17.10",
-    "@types/node": "^22.7.6",
+    "@types/lodash": "^4.17.12",
+    "@types/node": "^22.8.4",
     "@types/node-dijkstra": "^2.5.6",
     "@types/node-forge": "^1.3.11",
     "@types/semver": "^7.5.8",
diff --git a/server/src/plugin/runtime/node-thread-worker.ts b/server/src/plugin/runtime/node-thread-worker.ts
index 680202920..012a2fc12 100644
--- a/server/src/plugin/runtime/node-thread-worker.ts
+++ b/server/src/plugin/runtime/node-thread-worker.ts
@@ -13,11 +13,10 @@ class BufferTransfer implements RpcSerializer {
         if (!serializationContext)
             return this.bufferSerializer.serialize(value);
 
-        // node may used pooled buffers for Buffer.allocUnsafe, Buffer.from, and other calls.
-        // these buffers will be smaller than Buffer.poolSize.
-        // In these instances, do not transfer the buffer, as it may not be transferible.
-        // create a copy so it can be safely transfered.
-        if (value.buffer.byteLength <= Buffer.poolSize) {
+        // allow transfer of the buffer only if it sets the __rpc_transferable property.
+        // this is the only safe way to do this, since call sites may return the same buffer
+        // multiple times (like an image/jpeg MediaObject).
+        if ((value as any).__rpc_transferable === true) {
             const ab = value.buffer.slice(value.byteOffset, value.byteOffset + value.byteLength);
             value = Buffer.from(ab);
         }