diff --git a/frameworks/js/napi/vibrator/src/vibrator_napi_utils.cpp b/frameworks/js/napi/vibrator/src/vibrator_napi_utils.cpp
index ad59df24c25fe87fd17346468b01a02a0b84bea5..ba21ffbb92a98acb3759b72c65a4c785d5854ecc 100644
--- a/frameworks/js/napi/vibrator/src/vibrator_napi_utils.cpp
+++ b/frameworks/js/napi/vibrator/src/vibrator_napi_utils.cpp
@@ -531,17 +531,10 @@ void ExecuteCallBack(napi_env env, void *data)
 void EmitUvEventLoop(sptr<AsyncCallbackInfo> asyncCallbackInfo)
 {
     CHKPV(asyncCallbackInfo);
-    uv_loop_s *loop(nullptr);
-    CHKCV((napi_get_uv_event_loop(asyncCallbackInfo->env, &loop) == napi_ok), "napi_get_uv_event_loop fail");
-    CHKPV(loop);
-    uv_work_t *work = new(std::nothrow) uv_work_t;
-    CHKPV(work);
     asyncCallbackInfo->IncStrongRef(nullptr);
-    work->data = asyncCallbackInfo.GetRefPtr();
-    int32_t ret = uv_queue_work_with_qos(loop, work, [] (uv_work_t *work) { }, [] (uv_work_t *work, int status) {
-        CHKPV(work);
-        sptr<AsyncCallbackInfo> asyncCallbackInfo(static_cast<AsyncCallbackInfo *>(work->data));
-        DeleteWork(work);
+    auto event = asyncCallbackInfo.GetRefPtr();
+    auto task = [event]() {
+        sptr<AsyncCallbackInfo> asyncCallbackInfo(static_cast<AsyncCallbackInfo *>(event));
         /**
          * After the asynchronous task is created, the asyncCallbackInfo reference count is reduced
          * to 0 destruction, so you need to add 1 to the asyncCallbackInfo reference count when the
@@ -572,11 +565,11 @@ void EmitUvEventLoop(sptr<AsyncCallbackInfo> asyncCallbackInfo)
             napi_throw_error(env, nullptr, "napi_call_function callback fail");
             return;
         }
-    }, uv_qos_default);
-    if (ret != 0) {
-        MISC_HILOGE("uv_queue_work_with_qos fail");
+    };
+    auto ret = napi_send_event(asyncCallbackInfo->env, task, napi_eprio_immediate);
+    if (ret != napi_ok) {
+        MISC_HILOGE("Failed to SendEvent, ret:%{public}d", ret);
         asyncCallbackInfo->DecStrongRef(nullptr);
-        DeleteWork(work);
     }
 }
 
diff --git a/frameworks/native/vibrator/src/vibrator_service_client.cpp b/frameworks/native/vibrator/src/vibrator_service_client.cpp
index b53d19e9a66272bb0ac20420d1af5a5e45d453c2..8940813fd00fc4b865c267e92ea487a0f2334e56 100644
--- a/frameworks/native/vibrator/src/vibrator_service_client.cpp
+++ b/frameworks/native/vibrator/src/vibrator_service_client.cpp
@@ -51,6 +51,9 @@ static constexpr int32_t MAX_PATTERN_NUM = 1000;
 constexpr int32_t CURVE_FREQUENCY_NO_MODIFICATION = 0;
 constexpr int32_t CURVE_INTENSITY_NO_MODIFICATION = 100;
 constexpr int32_t CURVE_TIME_NO_MODIFICATION = 0;
+constexpr int32_t CURVE_POINT_NUM_MIN = 4;
+constexpr int32_t CURVE_POINT_NUM_MAX = 16;
+constexpr int32_t EVENT_NUM_MAX = 16;
 using namespace OHOS::HiviewDFX;
 
 namespace {
@@ -949,6 +952,10 @@ void VibratorServiceClient::ConvertSeekVibratorPackage(const VibratorPackage &co
             continue;
         }
         vibratePattern.startTime = seekTime;
+        if (completePackage.patterns[i].eventNum <= 0 || completePackage.patterns[i].eventNum > EVENT_NUM_MAX) {
+            MISC_HILOGE("The size of pattern is out of bounds, size:%{public}d", completePackage.patterns[i].eventNum);
+            return;
+        }
         for (int32_t j = 0; j < completePackage.patterns[i].eventNum; ++j) {
             VibrateEvent vibrateEvent = {};
             if (SkipEventAndConvertVibratorEvent(completePackage.patterns[i].events[j], vibratePattern,
@@ -965,7 +972,12 @@ void VibratorServiceClient::ConvertSeekVibratorPackage(const VibratorPackage &co
             vibrateEvent.intensity = completePackage.patterns[i].events[j].intensity;
             vibrateEvent.frequency = completePackage.patterns[i].events[j].frequency;
             vibrateEvent.index = completePackage.patterns[i].events[j].index;
-            for (size_t k = 0; k < static_cast<uint32_t>(completePackage.patterns[i].events[j].pointNum); ++k) {
+            int32_t pointNum = completePackage.patterns[i].events[j].pointNum;
+            if ((pointNum < CURVE_POINT_NUM_MIN) || (pointNum > CURVE_POINT_NUM_MAX)) {
+                MISC_HILOGE("The size of curve point is out of bounds, size:%{public}d", pointNum);
+                return;
+            }
+            for (size_t k = 0; k < static_cast<uint32_t>(pointNum); ++k) {
                 VibrateCurvePoint vibrateCurvePoint = {};
                 vibrateCurvePoint.time = completePackage.patterns[i].events[j].points[k].time;
                 vibrateCurvePoint.intensity = completePackage.patterns[i].events[j].points[k].intensity;
@@ -1259,7 +1271,7 @@ bool VibratorServiceClient::BinarySearchInterval(
         return true;
     }
     int32_t headIdx = 0;
-    int32_t tailIdx = interval.size() - 1;
+    int32_t tailIdx = static_cast<int32_t>(interval.size() - 1);
     while (tailIdx - headIdx > 1) {
         int32_t middleIdx = ((tailIdx - headIdx) / 2) + headIdx;
         if (interval[middleIdx].endTime < val) {