Commit Graph
11813 Commits
Author SHA1 Message Date
Nikita Skovoroda 66aab9f987 buffer: let Buffer.of use heap
PR-URL: https://github.com/nodejs/node/pull/60503
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
2026-02-24 00:36:55 +01:00
Antoine du Hamel e992057ab7 perf_hooks: fix stack overflow error
PR-URL: https://github.com/nodejs/node/pull/60084
Fixes: https://github.com/nodejs/node/issues/54768
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
2026-02-24 00:36:53 +01:00
Joyee Cheung 91dc00a2c1 debugger: fix event listener leak in the run command
It should remove both the error and the ready event listeners
attached when either of them fires, instead of removing only
the one whose corresponding event fires, otherwise the other
event listener will always get leaked.

PR-URL: https://github.com/nodejs/node/pull/60464
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
2026-02-24 00:36:44 +01:00
Chengzhong Wu 3e68a5f78a inspector: inspect HTTP response body
PR-URL: https://github.com/nodejs/node/pull/60572
Refs: https://github.com/nodejs/node/issues/53946
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Ryuhei Shima <shimaryuhei@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Kohei Ueno <kohei.ueno119@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
2026-02-24 00:36:44 +01:00
Gürgün Dayıoğlu 40a58709b4 console: optimize single-string logging
PR-URL: https://github.com/nodejs/node/pull/60422
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
2026-02-24 00:36:28 +01:00
Gürgün Dayıoğlu c3cf00c671 buffer: speed up concat via TypedArray#set
PR-URL: https://github.com/nodejs/node/pull/60399
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
2026-02-24 00:36:28 +01:00
Darshan Sen d8ac368363 http2: add diagnostics channels for client stream request body
These would allow inspection of HTTP/2 client stream request bodies.

Signed-off-by: Darshan Sen <raisinten@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/60480
Reviewed-By: Ilyas Shabi <ilyasshabi94@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
2026-02-24 00:36:28 +01:00
Ge Gao d77da9306c util: fix stylize of special properties in inspect
Previously, formatExtraProperties applied ctx.stylize to the entire
'[key]: value' string. This caused the colon and space to be styled,
making the output inconsistent with normal object properties.

Now, only the key itself is stylized, and the colon and space remain
unstyled, aligning with the formatting of regular properties.

Refs: https://github.com/nodejs/node/pull/60131
PR-URL: https://github.com/nodejs/node/pull/60479
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2026-02-24 00:36:27 +01:00
btea 7599e2eccd http: replace startsWith with strict equality
PR-URL: https://github.com/nodejs/node/pull/59394
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
2026-02-24 00:36:27 +01:00
Robert Nagy 221b77cf41 stream: don't try to read more if reading
Avoid unnecessary nextTick.

PR-URL: https://github.com/nodejs/node/pull/60454
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
2026-02-24 00:36:26 +01:00
Joyee Cheung 2e93650ebc src: fix timing of snapshot serialize callback
Previously the addAfterUserSerailizeCallback() wasn't
ready to be used for building the built-in snapshot.
This patch initializes the callbacks at the time
lib/internal/v8/start_snapshot.js is loaded, so that
these callbacks get run correctly when building the
built-in snapshot.

Currently when building the built-in snapshot,
addAfterUserSerializeCallback() is only used by createUnsafeBuffer(),
other usages can only come from user-land snapshots,
which is covered by tests, but what gets run by the
built-in snapshot building process is less visible, and the
path used by createUnsafeBuffer() isn't reliably visible in user
land either. This adds an internal usage counter in debug builds
to verify this path when building the built-in snapshot.

PR-URL: https://github.com/nodejs/node/pull/60434
Fixes: https://github.com/nodejs/node/issues/60423
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
2026-02-19 18:46:22 +01:00
Robert Nagy 99a85213bf http: lazy allocate cookies array
PR-URL: https://github.com/nodejs/node/pull/59734
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2026-02-19 18:46:22 +01:00
Antoine du Hamel 3a4edc8f6d util: use more defensive code when inspecting error objects
PR-URL: https://github.com/nodejs/node/pull/60139
Fixes: https://github.com/nodejs/node/issues/60107
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
2026-02-19 18:46:03 +01:00
Ruben Bridgewater 25c33af752 util: mark special properties when inspecting them
This makes sure special properties (such as a byteLength, buffer,
and more) are marked that they are not regular properties. They
are mostly getters, that just seemed even more of a breaking change.
Thus, they just use square brackets for now.

On top of that, it makes inspecting detached DataViews robust.
Inspecting those failed so far.

PR-URL: https://github.com/nodejs/node/pull/60131
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
2026-02-19 18:46:02 +01:00
Joyee Cheung 3f98b46716 vm: make vm.Module.evaluate() conditionally synchronous
- Make sure that the vm.Module.evaluate() method is conditionally
  synchronous based on the specification. Previously, the returned
  promise is unconditionally pending (even for synthetic modules and
  source text modules without top-level await) instead of immediately
  fulfilled, making it harder to debug as it deviates from the
  specified behavior.
- Clarify the synchronicity of this method in the documentation
- Add more tests for the synchronicity of this method.

PR-URL: https://github.com/nodejs/node/pull/60205
Refs: https://github.com/nodejs/node/issues/59656
Refs: https://github.com/nodejs/node/issues/37648
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
2026-02-19 18:46:01 +01:00
theanarkh 7669e6a5ad http: fix http client leaky with double response
PR-URL: https://github.com/nodejs/node/pull/60062
Fixes: https://github.com/nodejs/node/issues/60025
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
2026-02-17 19:16:42 +01:00
SeokHun 7cf4c43582 lib: fix constructor in _errnoException stack tree
Fixes the constructor name in the stack tree for _errnoException.

PR-URL: https://github.com/nodejs/node/pull/60156
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
2026-02-17 19:16:42 +01:00
Tobias Nießen e26a7e464d http2: rename variable to additionalPseudoHeaders
PR-URL: https://github.com/nodejs/node/pull/60208
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
2026-02-17 19:16:42 +01:00
SeokHun f9d87fbfaa lib: fix typo in QuicSessionStats
Corrects the misspelling of "privateSynbol" to "privateSymbol".

PR-URL: https://github.com/nodejs/node/pull/60155
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2026-02-17 19:16:41 +01:00
Gürgün Dayıoğlu 8d26ccc652 lib: remove redundant destroyHook checks
PR-URL: https://github.com/nodejs/node/pull/60120
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
2026-02-17 19:12:19 +01:00
Joyee Cheung db132b85a8 bootstrap: initialize http proxy after user module loader setup
The externalized undici relies on the user module loader, so
in the externalized build, initialization of http proxy which
relies on undici needs to be deferred until after the user module
loader is initialized.

PR-URL: https://github.com/nodejs/node/pull/58938
Refs: https://github.com/nodejs/node/issues/58865
Refs: https://github.com/nodejs/node/issues/57872
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2026-02-17 18:16:37 +01:00
Ruben Bridgewater 0bb1814fdf repl: fix pasting after moving the cursor to the left
Fixes: https://github.com/nodejs/node/issues/60446
PR-URL: https://github.com/nodejs/node/pull/60470
Reviewed-By: Jordan Harband <ljharb@gmail.com>
2026-02-17 16:19:29 +01:00
Matteo Collina 5df634f46e http2: validate initialWindowSize per HTTP/2 spec
The HTTP/2 spec (RFC 7540) defines SETTINGS_INITIAL_WINDOW_SIZE
maximum as 2^31-1. Values above this must be treated as a
FLOW_CONTROL_ERROR. Previously, Node.js allowed values up to
2^32-1 which caused nghttp2_submit_settings() to return
NGHTTP2_ERR_INVALID_ARGUMENT, triggering an uncatchable
assertion failure and crashing the process.

This change adds proper validation to reject values >= 2^31
with a catchable RangeError before they reach nghttp2.

PR-URL: https://github.com/nodejs/node/pull/61402
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Tim Perry <pimterry@gmail.com>
2026-02-17 15:39:31 +01:00
Efe b0186ff65c fs: validate statfs path
PR-URL: https://github.com/nodejs/node/pull/61230
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: LiviaMedeiros <livia@cirno.name>
2026-02-17 15:39:30 +01:00
Joyee Cheung 8674f6527f module: preserve URL in the parent created by createRequire()
Previously, createRequire() does not preserve the URL it gets
passed in the mock parent module created, which can be
observable if it's used together with module.registerHooks().
This patch adds preservation of the URL if createRequire()
is invoked with one.

PR-URL: https://github.com/nodejs/node/pull/60974
Fixes: https://github.com/nodejs/node/issues/60973
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
2026-02-17 15:14:21 +01:00
Chengzhong Wu 705832a1be lib,src: isInsideNodeModules should test on the first non-internal frame
PR-URL: https://github.com/nodejs/node/pull/60991
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Daniel Lemire <daniel@lemire.me>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
2026-02-17 15:14:07 +01:00
Mert Can Altin 7f0ffddc14 src: implement Windows-1252 encoding support and update related tests
PR-URL: https://github.com/nodejs/node/pull/60893
Fixes: https://github.com/nodejs/node/issues/60888
Fixes: https://github.com/nodejs/node/issues/59515
Fixes: https://github.com/nodejs/node/issues/56542
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
2026-02-17 15:12:40 +01:00
Filip Skokan a87499ae25 crypto: ensure documented RSA-PSS saltLength default is used
PR-URL: https://github.com/nodejs/node/pull/60662
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
2026-02-17 15:09:14 +01:00
René 2ccc9a6205 http2: do not crash on mismatched ping buffer length
PR-URL: https://github.com/nodejs/node/pull/60135
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2026-02-17 15:06:03 +01:00
d4d9f3915f src,lib: refactor unsafe buffer creation to remove zero-fill toggle
This removes the zero-fill toggle mechanism that allowed JavaScript
to control ArrayBuffer initialization via shared memory. Instead,
unsafe buffer creation now uses a dedicated C++ API.

Refs: https://hackerone.com/reports/3405778
Co-Authored-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/759
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/798
CVE-ID: CVE-2025-55131
2026-01-09 18:11:49 -03:00
RafaelGSS eb8e41f8db lib: add TLSSocket default error handler
This prevents the server from crashing due to an unhandled rejection
when a TLSSocket connection is abruptly destroyed during initialization
and the user has not attached an error handler to the socket.
e.g:

```js
const server = http2.createSecureServer({ ... })
server.on('secureConnection', socket => {
  socket.on('error', err => {
    console.log(err)
  })
})
```

PR-URL: https://github.com/nodejs-private/node-private/pull/797
Fixes: https://github.com/nodejs/node/issues/44751
Refs: https://hackerone.com/bugs?subject=nodejs&report_id=3262404
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
CVE-ID: CVE-2025-59465
2026-01-07 16:39:59 +01:00
Matteo Collina 25d6799df6 tls: route callback exceptions through error handlers
Wrap pskCallback and ALPNCallback invocations in try-catch blocks
to route exceptions through owner.destroy() instead of letting them
become uncaught exceptions. This prevents remote attackers from
crashing TLS servers or causing resource exhaustion.

Fixes: https://hackerone.com/reports/3473882
PR-URL: https://github.com/nodejs-private/node-private/pull/782
PR-URL: https://github.com/nodejs-private/node-private/pull/796
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
CVE-ID: CVE-2026-21637
2026-01-07 16:38:34 +01:00
RafaelGSS 6b4849583a lib,permission: require full read and write to symlink APIs
Refs: https://hackerone.com/reports/3417819
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/760
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
CVE-ID: CVE-2025-55130
2026-01-07 16:38:01 +01:00
RafaelGSS ebbf942a83 lib: disable futimes when permission model is enabled
Refs: https://hackerone.com/reports/3390084
PR-URL: https://github.com/nodejs-private/node-private/pull/748
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
CVE-ID: CVE-2025-55132
2026-01-07 16:37:53 +01:00
Haram Jeong ef67d09f50 http: improve writeEarlyHints by avoiding for-of loop
PR-URL: https://github.com/nodejs/node/pull/59958
Refs: https://github.com/nodejs/node/blob/main/doc/contributing/primordials.md#unsafe-array-iteration
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
2025-10-22 23:44:05 +02:00
Gürgün Dayıoğlu 56abc4ac76 lib: optimize priority queue
PR-URL: https://github.com/nodejs/node/pull/60039
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
2025-10-22 23:44:03 +02:00
BCD1me ea5cfd98c5 lib: implement passive listener behavior per spec
Implements the WHATWG DOM specification for passive event listeners,
ensuring that calls to `preventDefault()` are correctly ignored within
a passive listener context.

An internal `kInPassiveListener` state is added to the Event object
to track when a passive listener is executing. The `preventDefault()`
method and the `returnValue` setter are modified to check this state,
as well as the event's `cancelable` property. This state is reliably
cleaned up within a `finally` block to prevent state pollution in
case a listener throws an error.

This resolves previously failing Web Platform Tests (WPT) in
`AddEventListenerOptions-passive.any.js`.

Refs: https://dom.spec.whatwg.org/#dom-event-preventdefault
PR-URL: https://github.com/nodejs/node/pull/59995
Reviewed-By: Daeyeon Jeong <daeyeon.dev@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
2025-10-22 23:44:01 +02:00
Shima Ryuhei c2dd6eed2f process: fix wrong asyncContext under unhandled-rejections=strict
Fixes: https://github.com/nodejs/node/issues/60034
PR-URL: https://github.com/nodejs/node/pull/60103
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
2025-10-22 23:44:01 +02:00
Richard Lau 81a3055710 process: fix default env for process.execve
The `env` parameter for `process.execve` is documented to default
to `process.env`.

PR-URL: https://github.com/nodejs/node/pull/60029
Refs: https://github.com/nodejs/build/pull/4156
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
2025-10-22 23:44:01 +02:00
Ruben Bridgewater df72dc96e9 console,util: improve array inspection performance
There is no need to do the own property check, since the descriptor
is needed right afterwards anyway.

PR-URL: https://github.com/nodejs/node/pull/60037
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
2025-10-22 23:43:57 +02:00
Tim Perry 23468fd76b http2: fix allowHttp1+Upgrade, broken by shouldUpgradeCallback
This is required to use HTTP/1 websockets on an HTTP/2 server, which is
fairly common as websockets over HTTP/2 is much less widely supported.

This was broken by the recent shouldUpgradeCallback HTTP/1 addition,
which wasn't correctly added to the corresponding allowHttp1 part of
the HTTP/2 implementation.

PR-URL: https://github.com/nodejs/node/pull/59924
Backport-PR-URL: https://github.com/nodejs/node/pull/60341
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
2025-10-22 23:41:34 +02:00
Joyee Cheung 1486fedea1 cli: add --use-env-proxy
This does the same as NODE_USE_ENV_PROXY. When both are set,
like other options that can be configured from both sides,
the CLI flag takes precedence.

PR-URL: https://github.com/nodejs/node/pull/59151
Fixes: https://github.com/nodejs/node/issues/59100
Reviewed-By: Ilyas Shabi <ilyasshabi94@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
2025-10-18 20:35:56 +02:00
Joyee Cheung 42102594b1 http,https: add built-in proxy support in http/https.request and Agent
This patch implements proxy support for HTTP and HTTPS clients and
agents in the `http` and `https` built-ins`. When NODE_USE_ENV_PROXY
is set to 1, the default global agent would parse the
HTTP_PROXY/http_proxy, HTTPS_PROXY/https_proxy, NO_PROXY/no_proxy
settings from the environment variables, and proxy the requests
sent through the built-in http/https client accordingly.

To support this, `http.Agent` and `https.Agent` now accept a few new
options:

- `proxyEnv`: when it's an object, the agent would read and parse
  the HTTP_PROXY/http_proxy, HTTPS_PROXY/https_proxy, NO_PROXY/no_proxy
  properties from it, and apply them based on the protocol it uses
  to send requests. This option allows custom agents to
  reuse built-in proxy support by composing options. Global agents
  set this to `process.env` when NODE_USE_ENV_PROXY is 1.
- `defaultPort` and `protocol`: these allow setting of the default port
  and protocol of the agents. We also need these when configuring
  proxy settings and deciding whether a request should be proxied.

Implementation-wise, this adds a `ProxyConfig` internal class to handle
parsing and application of proxy configurations. The configuration
is parsed during agent construction. When requests are made,
the `createConnection()` methods on the agents would check whether
the request should be proxied. If yes, they either connect to the
proxy server (in the case of HTTP reqeusts) or establish a tunnel
(in the case of HTTPS requests) through either a TCP socket (if the
proxy uses HTTP) or a TLS socket (if the proxy uses HTTPS).

When proxying HTTPS requests through a tunnel, the connection listener
is invoked after the tunnel is established. Tunnel establishment uses
the timeout of the request options, if there is one. Otherwise it uses
the timeout of the agent.

If an error is encountered during tunnel establishment, an
ERR_PROXY_TUNNEL would be emitted on the returned socket. If the proxy
server sends a errored status code, the error would contain an
`statusCode` property. If the error is caused by timeout, the error
would contain a `proxyTunnelTimeout` property.

This implementation honors the built-in socket pool and socket limits.
Pooled sockets are still keyed by request endpoints, they are just
connected to the proxy server instead, and the persistence of the
connection can be maintained as long as the proxy server respects
connection/proxy-connection or persist by default (HTTP/1.1)

PR-URL: https://github.com/nodejs/node/pull/58980
Refs: https://github.com/nodejs/node/issues/57872
Refs: https://github.com/nodejs/node/issues/8381
Refs: https://github.com/nodejs/node/issues/15620
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
2025-10-18 12:07:57 +02:00
Joyee Cheung bedaaa11fc http: support http proxy for fetch under NODE_USE_ENV_PROXY
When enabled, Node.js parses the `HTTP_PROXY`, `HTTPS_PROXY` and
`NO_PROXY` environment variables during startup, and tunnels requests
over the specified proxy.

This currently only affects requests sent over `fetch()`. Support for
other built-in `http` and `https` methods is under way.

PR-URL: https://github.com/nodejs/node/pull/57165
Refs: https://github.com/nodejs/undici/issues/1650
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
2025-10-18 12:07:52 +02:00
Chengzhong Wu 6277058e43 vm: sync-ify SourceTextModule linkage
Split `module.link(linker)` into two synchronous step
`sourceTextModule.linkRequests()` and
`sourceTextModule.instantiate()`. This allows creating vm modules and
resolving the dependencies in a complete synchronous procedure.

This also makes `syntheticModule.link()` redundant. The link step for a
SyntheticModule is no-op and is already taken care in the constructor
by initializing the binding slots with the given export names.

PR-URL: https://github.com/nodejs/node/pull/59000
Backport-PR-URL: https://github.com/nodejs/node/pull/60152
Refs: https://github.com/nodejs/node/issues/37648
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
2025-10-11 22:51:07 +02:00
Joyee Cheung 095e7a81fc tls: only do off-thread certificate loading on loading tls
This patch makes the off-thread loading lazy and only done when the
`tls` builtin is actually loaded by the application. Thus if the
application never uses tls, it would not get hit by the extra
off-thread loading overhead. paving the way to enable --use-system-ca
by default.

PR-URL: https://github.com/nodejs/node/pull/59856
Reviewed-By: James M Snell <jasnell@gmail.com>
2025-10-11 20:49:13 +02:00
Renegade334 1f93913446 crypto: use return await when returning Promises from async functions
This offers _some_ resistance to `%Promise.prototype%` pollution.

Refs: https://github.com/nodejs/node/issues/59699
PR-URL: https://github.com/nodejs/node/pull/59841
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
2025-10-11 20:49:13 +02:00
Renegade334 f488b2ff73 crypto: use async functions for non-stub Promise-returning functions
These were intended to mimic simple async functions, but exceptions
thrown in the function body would be returned synchronously, not
wrapped in a rejected Promise.

PR-URL: https://github.com/nodejs/node/pull/59841
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
2025-10-11 20:49:13 +02:00
Renegade334 aed9fd5ac4 crypto: avoid calls to promise.catch()
This avoids explicit calls to the user-mutable
`%Promise.prototype%.catch`, and by association, implicit calls to the
user-mutable `%Promise.prototype%.then`.

PR-URL: https://github.com/nodejs/node/pull/59841
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
2025-10-11 20:49:13 +02:00
Yoo 3a3220a2f0 dgram: restore buffer optimization in fixBufferList
Restore the Buffer.isBuffer() check to avoid unnecessary Buffer.from()
calls when the input is already a Buffer. This improves performance
by 30-50% for buffer-heavy UDP operations.

Includes benchmark test for fixBufferList function to verify the
performance improvements across different data types and chunk sizes.

PR-URL: https://github.com/nodejs/node/pull/59934
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
2025-10-07 17:29:41 +02:00