Using an internal field instead of a `v8::Global<>` removes
an unnecessary memory leak footgun.
This includes a test that demonstrates the issue, albeit
using internal APIs.
It's worth noting that if this PR is not accepted, we'd still
be missing memory tracking for the `context_frame_` field,
and we'd need to add it through our memory tracking API.
PR-URL: https://github.com/nodejs/node/pull/62103
Backport-PR-URL: https://github.com/nodejs/node/pull/62357
Reviewed-By: Anna Henningsen <anna@addaleax.net>
This intended to replace usage of the unsupported _external field,
offering an official API for native addons to access OpenSSL directly
while reducing the JS API and internal field exposure.
PR-URL: https://github.com/nodejs/node/pull/62254
Reviewed-By: Anna Henningsen <anna@addaleax.net>
When pipelined requests arrive in one TCP segment, llhttp_execute()
parses them all in a single call. If a synchronous 'close' event
handler invokes freeParser() mid-execution, cleanParser() nulls out
parser state while llhttp_execute() is still on the stack, crashing on
the next callback.
Add an is_being_freed_ flag that freeParser() sets via
parser.markFreed() before cleaning state. Proxy::Raw checks the flag
before every callback and returns HPE_USER to abort execution early if
set.
PR-URL: https://github.com/nodejs/node/pull/62095
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
This aligns zstd streams with other compression libraries in this
regard, and enables releasing memory early when the stream ends in
JS instead of waiting for GC to clean up the wrapper object (which
is a problem that is exacerbated in the zstd context because we
do not track memory and report memory pressure to V8 yet).
PR-URL: https://github.com/nodejs/node/pull/61717
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Newer c-ares versions set tcp_port/udp_port to 53 instead of 0,
which caused the loopback detection to fail. This fix:
- Removes the port check from loopback detection
- Adds IPv6 loopback (::1) support
- Calls EnsureServers() before each DNS query
PR-URL: https://github.com/nodejs/node/pull/61453
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Other threads can still hold a valid handle to the tsfn after
finalization if finalization was triggered by
- release with napi_tsfn_abort, or
- environment shutdown
Handle this by:
- protecting finalization itself with the mutex
- if necessary, delay deletion after finalization to when thread_count
drops to 0
- releasing all resources as soon as possible before deletion
Fixes: https://github.com/nodejs/node/issues/55706
PR-URL: https://github.com/nodejs/node/pull/55877
Co-Authored-By: Gabriel Schulhof <gabrielschulhof@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
The Reset() method did not check the write_in_progress_ flag before
resetting the compression stream. This allowed reset() to free the
compression library's internal state while a worker thread was still
using it during an async write, causing a use-after-free.
Add a write_in_progress_ guard to Reset() that throws an error if a
write is in progress, matching the existing pattern used by Close()
and Write().
PR-URL: TODO
Refs: https://hackerone.com/reports/3609132
PR-URL: https://github.com/nodejs/node/pull/62325
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
This function can return null, which will make the calls to
BIO_meth_set_* trigger a null deref.
Even after fixing this, there is an issue with the
`BIOPointer::New(GetMethod())` call in `NodeBIO::New` because the
`New` method cannot handle a null pointer despite other code already
guarding for this
(e.g. the `NodeBIO::New` function already checks `bio`).
This patch solves the issues by adding more null checks.
PR-URL: https://github.com/nodejs/node/pull/61788
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
In TextEncoder.encodeInto, the destination buffer's byte length is
read as a size_t but then implicitly narrowed to int when passed as
the capacity argument to v8::String::WriteUtf8. When the destination
view is larger than INT_MAX (2,147,483,647 bytes), the narrowing
conversion underflows to a negative value, V8 treats it as "no
capacity", and writes 0 bytes - returning { read: 0, written: 0 }
even though the buffer has plenty of room.
Clamp the capacity to INT_MAX before passing it to WriteUtf8. This
is sufficient because the source string in encodeInto is bounded in
practice and never requires more than INT_MAX bytes to encode; only
the destination view length can exceed INT_MAX.
This issue is already fixed on main and v24.x as a side effect of
PR #58070, which migrated to the non-deprecated WriteUtf8V2 method
whose capacity parameter is size_t. WriteUtf8V2 is not available in
v22.x's V8 version, so this minimal patch fixes only the EncodeInto
path instead of backporting the full migration.
Refs: https://github.com/nodejs/node/pull/58070
Fixes: https://github.com/nodejs/node/issues/62610
Signed-off-by: semimikoh <ejffjeosms@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62621
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
This is a security release.
Notable changes:
build,test,deps:
* (CVE-2026-21717) test array index hash collision
crypto:
* (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC
http:
* (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct
permission:
* (CVE-2026-21716) include permission check on lib/fs/promises
* (CVE-2026-21715) add permission check to realpath.native
src:
* (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code
tls:
* (CVE-2026-21637) wrap SNICallback invocation in try/catch
PR-URL: https://github.com/nodejs-private/node-private/pull/844
This is the same as the original change, minus the `process.emitWarning`
calls and unit tests that expect the deprecation warnings.
Original commit message:
lib: deprecate _tls_common and _tls_wrap
runtime deprecate the _tls_common and _tls_wrap
modules, users should use nust node:tls insteal
and internally internal/tls/commond and
internal/tls/wrap should be used instead
PR-URL: https://github.com/nodejs/node/pull/57643
Backport-PR-URL: https://github.com/nodejs/node/pull/62231
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
Co-authored-by: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <targos@protonmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Antoine du Hamel