When a stack overflow exception occurs during async_hooks callbacks
(which use TryCatchScope::kFatal), detect the specific "Maximum call
stack size exceeded" RangeError and re-throw it instead of immediately
calling FatalException. This allows user code to catch the exception
with try-catch blocks instead of requiring uncaughtException handlers.
The implementation adds IsStackOverflowError() helper to detect stack
overflow RangeErrors and re-throws them in TryCatchScope destructor
instead of calling FatalException.
This fixes the issue where async_hooks would cause stack overflow
exceptions to exit with code 7 (kExceptionInFatalExceptionHandler)
instead of being catchable.
Fixes: https://github.com/nodejs/node/issues/37989
Ref: https://hackerone.com/reports/3456295
PR-URL: https://github.com/nodejs-private/node-private/pull/773
Refs: https://hackerone.com/reports/3456295
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
CVE-ID: CVE-2025-59466
Specifically, avoid the hazard of unintentionally evaluating
an argument multiple times during macro expansion, and do not
assume the available of particular namespaces in the current scope.
PR-URL: https://github.com/nodejs/node/pull/60053
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Implements the WHATWG DOM specification for passive event listeners,
ensuring that calls to `preventDefault()` are correctly ignored within
a passive listener context.
An internal `kInPassiveListener` state is added to the Event object
to track when a passive listener is executing. The `preventDefault()`
method and the `returnValue` setter are modified to check this state,
as well as the event's `cancelable` property. This state is reliably
cleaned up within a `finally` block to prevent state pollution in
case a listener throws an error.
This resolves previously failing Web Platform Tests (WPT) in
`AddEventListenerOptions-passive.any.js`.
Refs: https://dom.spec.whatwg.org/#dom-event-preventdefault
PR-URL: https://github.com/nodejs/node/pull/59995
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
This patch implements proxy support for HTTP and HTTPS clients and
agents in the `http` and `https` built-ins`. When NODE_USE_ENV_PROXY
is set to 1, the default global agent would parse the
HTTP_PROXY/http_proxy, HTTPS_PROXY/https_proxy, NO_PROXY/no_proxy
settings from the environment variables, and proxy the requests
sent through the built-in http/https client accordingly.
To support this, `http.Agent` and `https.Agent` now accept a few new
options:
- `proxyEnv`: when it's an object, the agent would read and parse
the HTTP_PROXY/http_proxy, HTTPS_PROXY/https_proxy, NO_PROXY/no_proxy
properties from it, and apply them based on the protocol it uses
to send requests. This option allows custom agents to
reuse built-in proxy support by composing options. Global agents
set this to `process.env` when NODE_USE_ENV_PROXY is 1.
- `defaultPort` and `protocol`: these allow setting of the default port
and protocol of the agents. We also need these when configuring
proxy settings and deciding whether a request should be proxied.
Implementation-wise, this adds a `ProxyConfig` internal class to handle
parsing and application of proxy configurations. The configuration
is parsed during agent construction. When requests are made,
the `createConnection()` methods on the agents would check whether
the request should be proxied. If yes, they either connect to the
proxy server (in the case of HTTP reqeusts) or establish a tunnel
(in the case of HTTPS requests) through either a TCP socket (if the
proxy uses HTTP) or a TLS socket (if the proxy uses HTTPS).
When proxying HTTPS requests through a tunnel, the connection listener
is invoked after the tunnel is established. Tunnel establishment uses
the timeout of the request options, if there is one. Otherwise it uses
the timeout of the agent.
If an error is encountered during tunnel establishment, an
ERR_PROXY_TUNNEL would be emitted on the returned socket. If the proxy
server sends a errored status code, the error would contain an
`statusCode` property. If the error is caused by timeout, the error
would contain a `proxyTunnelTimeout` property.
This implementation honors the built-in socket pool and socket limits.
Pooled sockets are still keyed by request endpoints, they are just
connected to the proxy server instead, and the persistence of the
connection can be maintained as long as the proxy server respects
connection/proxy-connection or persist by default (HTTP/1.1)
PR-URL: https://github.com/nodejs/node/pull/58980
Refs: https://github.com/nodejs/node/issues/57872
Refs: https://github.com/nodejs/node/issues/8381
Refs: https://github.com/nodejs/node/issues/15620
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
When enabled, Node.js parses the `HTTP_PROXY`, `HTTPS_PROXY` and
`NO_PROXY` environment variables during startup, and tunnels requests
over the specified proxy.
This currently only affects requests sent over `fetch()`. Support for
other built-in `http` and `https` methods is under way.
PR-URL: https://github.com/nodejs/node/pull/57165
Refs: https://github.com/nodejs/undici/issues/1650
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Add validation to ensure that --max-old-space-size-percentage cannot
be used when available memory cannot be calculated, preventing
undefined behavior when memory detection fails.
Also enhance test-process-constrained-memory.js to support testing
in constrained environments where memory calculation may fail.
PR-URL: https://github.com/nodejs/node/pull/59460
Backport-PR-URL: https://github.com/nodejs/node/pull/59631
Reviewed-By: theanarkh <theratliter@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Matteo Collina