BackPup/node
1
0 Fork 0
mirror of https://github.com/nodejs/node.git synced 2026-11-09 15:11:11 -05:00
Code Issues Packages Projects Releases Wiki Activity
45,088 Commits 266 Branches 972 Tags
fbfbc83809cfcd8b128f8c6283fbe5aed5e022b2
Commit Graph
9963 Commits
Author SHA1 Message Date
Nikita Skovoroda f5e11a2d5f test: fix test-buffer-zero-fill-cli to be effective 
PR-URL: https://github.com/nodejs/node/pull/60623
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2026-07-19 17:30:55 -05:00
Yuya Inoue c5870843a8 test: wait for reattach before initial break on restart 
PR-URL: https://github.com/nodejs/node/pull/62471
Refs: https://github.com/nodejs/node/issues/61762
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Kohei Ueno <kohei.ueno119@gmail.com>
 2026-07-19 17:30:54 -05:00
Mert Can Altin d996238946 src: handle null backing store in ArrayBufferViewContents::Read 
Fixes: https://github.com/nodejs/node/issues/62342

src: handle null backing store in ArrayBufferViewContents::Read
PR-URL: https://github.com/nodejs/node/pull/62343
Fixes: https://github.com/nodejs/node/issues/62342
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2026-07-19 17:30:54 -05:00
Yuya Inoue 5ca31e53da test: avoid flaky run wait in debugger restart test 
PR-URL: https://github.com/nodejs/node/pull/62112
Refs: https://github.com/nodejs/node/issues/61762
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-07-19 17:30:53 -05:00
Matteo Collina 7748f609c2 test_runner: make it compatible with fake timers 
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/59272
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
 2026-07-19 17:30:53 -05:00
kovanandjorge guerrero 2d4e35961d doc,test: clarify --eval syntax for leading '-' scripts 
If the script passed to --eval starts with a hyphen, the CLI parser
treats it as another option flag. Document the --eval=<script> form
as the workaround and add tests for --eval=-42, --eval=-0, and the
-e -p missing-argument error.

Co-authored-by: jorge guerrero <grrr.jrg@gmail.com>
Refs: https://github.com/nodejs/node/issues/43397
Refs: https://github.com/nodejs/node/pull/61962
PR-URL: https://github.com/nodejs/node/pull/62244
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2026-07-19 17:30:52 -05:00
Filip Skokan cd6941d391 crypto: read algorithm name property only once in normalizeAlgorithm 
PR-URL: https://github.com/nodejs/node/pull/62170
Refs: https://redirect.github.com/web-platform-tests/wpt/pull/57614#pullrequestreview-3808145365
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2026-07-19 17:30:50 -05:00
Gerhard Stöbich a89339faf5 http: fix use-after-free when freeParser is called during llhttp_execute 
When pipelined requests arrive in one TCP segment, llhttp_execute()
parses them all in a single call. If a synchronous 'close' event
handler invokes freeParser() mid-execution, cleanParser() nulls out
parser state while llhttp_execute() is still on the stack, crashing on
 the next callback.

Add an is_being_freed_ flag that freeParser() sets via
parser.markFreed() before cleaning state. Proxy::Raw checks the flag
before every callback and returns HPE_USER to abort execution early if
set.

PR-URL: https://github.com/nodejs/node/pull/62095
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
 2026-07-19 17:30:49 -05:00
Marco 2308c74ad9 stream: fix TransformStream race on cancel with pending write 
Signed-off-by: marcopiraccini <marco.piraccini@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62040
Fixes: https://github.com/nodejs/node/issues/62036
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
 2026-07-19 17:30:48 -05:00
Gerhard Stöbich cd6368089a src: release context frame in AsyncWrap::EmitDestroy 
Release the async context frame in AsyncWrap::EmitDestroy to allow
gc to collect it.

This is in special relevant for reused resources like HTTPParser
otherwise they might keep ALS stores alive.

PR-URL: https://github.com/nodejs/node/pull/61995
Fixes: https://github.com/nodejs/node/issues/61882
Refs: https://github.com/nodejs/node/pull/48528
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
 2026-07-19 17:30:48 -05:00
Antoine du Hamel aab80f9595 test: fix skipping behavior for test-runner-run-files-undefined 
PR-URL: https://github.com/nodejs/node/pull/62026
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2026-07-19 17:30:48 -05:00
Matteo Collina 775ae50221 http: validate ClientRequest path on set 
The `path` property on `ClientRequest` was only validated at
construction time. Add a getter/setter so that the same
`INVALID_PATH_REGEX` check runs whenever `req.path` is reassigned,
preventing invalid characters from reaching `_implicitHeader()`.

PR-URL: https://github.com/nodejs/node/pull/62030
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
 2026-07-19 17:30:47 -05:00
Richard Clarke 956d8db822 http: validate headers in writeEarlyHints 
Add validateHeaderName/validateHeaderValue checks for non-link
headers and checkInvalidHeaderChar for the Link value in HTTP/1.1
writeEarlyHints, closing a CRLF injection gap where header names
and values were concatenated into the raw response without
validation.

Also tighten linkValueRegExp to reject CR/LF inside the <...>
URL portion of Link header values.

PR-URL: https://github.com/nodejs/node/pull/61897
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
 2026-07-19 17:30:47 -05:00
Antoine du Hamel b420154efc test: remove unnecessary process.exit calls from test files 
PR-URL: https://github.com/nodejs/node/pull/62020
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
 2026-07-19 17:30:46 -05:00
Mert Can Altin 8ec00f4711 buffer: optimize buffer.concat performance 
PR-URL: https://github.com/nodejs/node/pull/61721
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
 2026-07-19 17:30:46 -05:00
Yuya Inoue 4106f9be6d test: avoid flaky debugger restart waits 
PR-URL: https://github.com/nodejs/node/pull/61773
Refs: https://github.com/nodejs/node/issues/61762
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-07-19 17:30:46 -05:00
Igor Shevelenkov 263129fb93 test_runner: run afterEach on runtime skip 
Signed-off-by: Igor <igorshevelenkov4@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/61525
Fixes: https://github.com/nodejs/node/issues/61462
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
 2026-07-19 17:30:45 -05:00
Marco afb7270785 child_process: add tracing channel for spawn 
Signed-off-by: marcopiraccini <marco.piraccini@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/61836
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2026-07-19 17:30:45 -05:00
Hiroki Osame 5d0a1b522f util: add fast path to stripVTControlCharacters 
PR-URL: https://github.com/nodejs/node/pull/61833
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-07-19 17:30:45 -05:00
RajeshKumar11 b75073d5aa http: attach error handler to socket synchronously in onSocket 
Between onSocket and onSocketNT, the socket had no error handler,
meaning any errors emitted during that window (e.g. from a blocklist
check or custom lookup) would be unhandled even if the user had set up
a request error handler.

Fix this by attaching socketErrorListener synchronously in onSocket,
setting socket._httpMessage so the listener can forward errors to the
request. The _destroy path in onSocketNT is also guarded to prevent
double-firing if socketErrorListener already emitted the error.

Fixes: https://github.com/nodejs/node/issues/48771
Refs: https://github.com/nodejs/node/pull/61658
PR-URL: https://github.com/nodejs/node/pull/61770
Refs: https://github.com/nodejs/node/issues/48771
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
 2026-07-19 17:30:42 -05:00
giulioAZGiulio ComiCaleb EverettUtku Yildirim
 		a944283631 worker: eliminate race condition in process.cwd() 
Fixes a race condition in worker thread cwd caching where the counter
is incremented before the directory change completes, allowing workers
to cache stale directory values.

In lib/internal/worker.js, the main thread's process.chdir() wrapper
previously incremented the shared counter before calling the actual
chdir(), creating a race window where workers could read the old
directory but cache it with the new counter value. This caused
subsequent cwd() calls to return incorrect paths until the next chdir().

This fix reorders the operations to change the directory first, then
increment the counter, ensuring workers are only notified after the
directory change completes.

Before fix: 54.28% error rate (311/573 races)
After fix: 0% error rate (0/832 races)

Refs: https://hackerone.com/reports/3407207
Co-authored-by: Giulio Comi
Co-authored-by: Caleb Everett
Co-authored-by: Utku Yildirim
PR-URL: https://github.com/nodejs/node/pull/61664
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
 2026-07-19 17:30:42 -05:00
Ali Hassan bf3ff4b226 sqlite: avoid extra copy for large text binds 
When binding UTF-8 strings to prepared statements, transfer ownership of
malloc-backed Utf8Value buffers to SQLite to avoid an extra copy for
large strings. Use sqlite3_bind_blob64() when binding BLOB parameters.

PR-URL: https://github.com/nodejs/node/pull/61580
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>
 2026-07-19 17:30:39 -05:00
RajeshKumar11 1f999d2c8b net: defer synchronous destroy calls in internalConnect 
Defer socket.destroy() calls in internalConnect and
internalConnectMultiple to the next tick. This ensures that error
handlers have a chance to be set up before errors are emitted,
particularly important when using http.request with a custom
lookup function that returns synchronously.

Previously, if a synchronous lookup function returned an IP that
triggered an immediate error (e.g., via blockList), the error would
be emitted before the HTTP client had set up its error handler
(which happens via process.nextTick in onSocket). This caused
unhandled 'error' events.

Fixes: https://github.com/nodejs/node/issues/48771
PR-URL: https://github.com/nodejs/node/pull/61658
Refs: https://github.com/nodejs/node/pull/51038
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
 2026-07-19 17:30:39 -05:00
notvivek12 92dec8a06e dns: fix Windows SRV ECONNREFUSED by adjusting c-ares fallback detection 
Newer c-ares versions set tcp_port/udp_port to 53 instead of 0,
which caused the loopback detection to fail. This fix:

- Removes the port check from loopback detection
- Adds IPv6 loopback (::1) support
- Calls EnsureServers() before each DNS query

PR-URL: https://github.com/nodejs/node/pull/61453
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2026-07-19 17:30:39 -05:00
Edy Silva 4edecac522 test_runner: fix test enqueue when test file has syntax error 
PR-URL: https://github.com/nodejs/node/pull/61573
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
 2026-07-19 17:30:36 -05:00
Mohamed Akram 27fb167f77 process: do not truncate long strings in --print 
Fixes: https://github.com/nodejs/node/issues/61337
PR-URL: https://github.com/nodejs/node/pull/61497
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
 2026-07-19 17:30:36 -05:00
Heath Dutton🕴️ cba42aad5e test_runner: fix coverage report when a directory is named file 
The coverage tree traversal checked `tree[key].file` to detect file
entries. When a directory named "file" contained a file also named
"file", this check incorrectly matched the child entry instead of
file metadata, causing a TypeError when accessing `.path`.

Check for `.file?.path` instead to correctly identify file metadata.

Fixes: https://github.com/nodejs/node/issues/61080
PR-URL: https://github.com/nodejs/node/pull/61169
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Pietro Marchini <pietro.marchini94@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
 2026-07-19 17:30:34 -05:00
Antoine du Hamel f85c73979b test: ensure assertions are reached on more tests 
PR-URL: https://github.com/nodejs/node/pull/60500
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Zijian Liu <lxxyxzj@gmail.com>
 2026-07-19 17:30:33 -05:00
Antoine du Hamel 509f27343d test: ensure assertions are reachable in more folders 
PR-URL: https://github.com/nodejs/node/pull/60411
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
 2026-07-19 17:30:33 -05:00
Shima Ryuhei e797fa0972 inspector: fix crash when receiving non json message 
PR-URL: https://github.com/nodejs/node/pull/60388
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Kohei Ueno <kohei.ueno119@gmail.com>
 2026-07-19 17:30:33 -05:00
Joyee Cheung 54112cee3e test_runner: use module.registerHooks in module mocks 
Migrate away from module.register(). This no longer needs to
deal with the worker synchronization.

PR-URL: https://github.com/nodejs/node/pull/60326
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
 2026-07-19 17:30:32 -05:00
Richard Lau c6e08cd3ae test: mark test-runner-run-watch flaky on macOS 
`parallel/test-runner-run-watch` has failed 33 out of the last 100
CI runs on macOS. It is already marked flaky on other platforms.

PR-URL: https://github.com/nodejs/node/pull/60115
Refs: https://github.com/nodejs/node/issues/54534
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-07-17 17:07:33 -05:00
Renegade334 bfab50300a perf_hooks: fix histogram fast call signatures 
PR-URL: https://github.com/nodejs/node/pull/59600
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2026-07-17 17:07:32 -05:00
Matteo Collina eaa292549e http: avoid stream listeners on idle agent sockets 
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/64004
Fixes: https://github.com/nodejs/node/issues/63989
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
 2026-06-22 12:22:52 -03:00
Matteo Collina 0a22d40180 http: fix response queue poisoning in http.Agent 
Attach a data guard listener on idle keepAlive sockets in the
freeSockets pool. If unsolicited data arrives while the socket
is idle, destroy it immediately to prevent response queue poisoning.

Refs: https://hackerone.com/reports/3582376
PR-URL: https://github.com/nodejs-private/node-private/pull/846
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48931
 2026-06-17 19:52:20 +02:00
RafaelGSS 28dcd38864 permission: disable FileHandle utimes with permission model 
PR-URL: https://github.com/nodejs-private/node-private/pull/873
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48935
Refs: https://hackerone.com/reports/3625987
 2026-06-17 19:52:20 +02:00
Matteo Collina 1662a3ea09 test: add session reuse host verification regressions 
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/895
PR-URL: https://github.com/nodejs-private/node-private/pull/854
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Refs: https://hackerone.com/reports/3649802
 2026-06-17 19:52:19 +02:00
Matteo Collina c551a51d0c dns,net: reject hostnames with embedded NUL bytes 
Ref: https://hackerone.com/reports/3656716
PR-URL: https://github.com/nodejs-private/node-private/pull/868
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48930
Refs: https://hackerone.com/reports/3656716
 2026-06-17 19:52:19 +02:00
Matteo Collina 39d1d09684 tls: fix case-sensitive SNI context matching 
The regex constructed by server.addContext() lacked the case-insensitive
flag, causing uppercase or mixed-case SNI hostnames from ClientHello to
miss their intended context and fall back to the default context. This
violates RFC 6066 Section 3, which states that DNS hostnames are
case-insensitive. In mTLS configurations with per-tenant contexts, this
allowed bypassing client certificate authorization by simply
uppercasing the SNI hostname.

Add the 'i' flag to the RegExp in addContext() so that SNI matching
is case-insensitive.

PR-URL: https://github.com/nodejs-private/node-private/pull/857
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48928
Refs: https://hackerone.com/reports/3656869
 2026-06-17 19:52:19 +02:00
Matteo Collina c79968e108 http2: cap originSet size to prevent unbounded memory growth 
A malicious HTTP/2 server can send repeated ORIGIN frames with unique
origins, causing unbounded growth of the client-side originSet for the
lifetime of the session. Cap the set at 128 entries; once full, new
origins from ORIGIN frames are silently dropped.

Ref: https://hackerone.com/reports/3676863
PR-URL: https://github.com/nodejs-private/node-private/pull/855
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48619
Refs: https://hackerone.com/reports/3676863
 2026-06-17 19:52:19 +02:00
Matteo Collina 2197a47144 tls: normalize hostname for server identity checks 
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/869
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/893
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48618
Refs: https://hackerone.com/reports/3688064
 2026-06-17 19:52:19 +02:00
RafaelGSS 2f62693801 permission: handle process.chdir on writereport 
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: https://github.com/nodejs-private/node-private/pull/870
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48617
Refs: https://hackerone.com/reports/3625987
 2026-06-17 19:52:19 +02:00
Tim Perry a1a5bb9683 deps: fix integration issues with the latest nghttp2 
This is a set of src & tests fixes for nghttp2 due to changes in
v1.67.0+ which require a selection of changes to how we handle
low-level protocol errors when using the latest versions of nghttp2,
changing both some src error handling and updating some tests to match.

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62891
Backport-PR-URL: https://github.com/nodejs/node/pull/63195
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Refs: https://hackerone.com/reports/3658225
CVE-ID: CVE-2026-48937
 2026-06-17 19:51:32 +02:00
KaKa 0c37bff2ff http2: fix DEP0194 message 
PR-URL: https://github.com/nodejs/node/pull/58669
Backport-PR-URL: https://github.com/nodejs/node/pull/63195
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2026-06-16 14:24:45 +02:00
Matteo CollinaandAntoine du Hamel ea5dc6b529 http2: remove support for priority signaling 
Signed-off-by: Matteo Collina <hello@matteocollina.com>
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
Refs: https://datatracker.ietf.org/doc/html/rfc9113#section-5.3.1
PR-URL: https://github.com/nodejs/node/pull/58293
Backport-PR-URL: https://github.com/nodejs/node/pull/63195
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
 2026-06-16 14:24:43 +02:00
Richard Lau 718d5d0e2c test: skip test-fs-utimes-y2K38 on armv7 
`parallel/test-fs-utimes-y2K38` appears to be broken on 32-bit armv7
systems where the underlying filesystem supports y2k38.

Signed-off-by: Richard Lau <richard.lau@ibm.com>
PR-URL: https://github.com/nodejs/node/pull/63836
Refs: https://github.com/nodejs/node/issues/63835
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Stewart X Addison <sxa@redhat.com>
Reviewed-By: LiviaMedeiros <livia@cirno.name>
 2026-06-12 18:00:10 +00:00
Stewart X Addison 041185b61f test: skip test-cluster-dgram-reuse on AIX 7.3 
Signed-off-by: Stewart X Addison <sxa@ibm.com>
PR-URL: https://github.com/nodejs/node/pull/62238
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
 2026-06-10 17:15:09 +00:00
Matteo Collina ad8f518a81 zlib: fix use-after-free when reset() is called during write 
The Reset() method did not check the write_in_progress_ flag before
resetting the compression stream. This allowed reset() to free the
compression library's internal state while a worker thread was still
using it during an async write, causing a use-after-free.

Add a write_in_progress_ guard to Reset() that throws an error if a
write is in progress, matching the existing pattern used by Close()
and Write().

PR-URL: TODO
Refs: https://hackerone.com/reports/3609132
PR-URL: https://github.com/nodejs/node/pull/62325
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
 2026-05-11 16:10:17 +02:00
Chengzhong Wu aa2c1eca04 lib: fix source map url parse in dynamic imports 
PR-URL: https://github.com/nodejs/node/pull/61990
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
 2026-05-11 16:10:16 +02:00
Thomas Watson 57c3035fec stream: fix decoded fromList chunk boundary check 
Correct `fromList()` in decoded string mode to compare `n` against the
current chunk length, not the buffer array length.

This prevents over-consuming chunks, which can corrupt readable state
and crash with `TypeError` when mixing `setEncoding()` and `read(n)`.

PR-URL: https://github.com/nodejs/node/pull/61884
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Ilyas Shabi <ilyasshabi94@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
 2026-05-11 16:10:16 +02:00