Wrap the owner._SNICallback() invocation in loadSNI() with try/catch
to route exceptions through owner.destroy() instead of letting them
become uncaught exceptions. This completes the fix from CVE-2026-21637
which added try/catch protection to callALPNCallback,
onPskServerCallback, and onPskClientCallback but missed loadSNI().
Without this fix, a remote unauthenticated attacker can crash any
Node.js TLS server whose SNICallback may throw on unexpected input
by sending a single TLS ClientHello with a crafted server_name value.
Fixes: https://hackerone.com/reports/3556769
Refs: https://hackerone.com/reports/3473882
CVE-ID: CVE-2026-21637
PR-URL: https://github.com/nodejs-private/node-private/pull/819
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2026-21637
Use { __proto__: null } instead of {} when initializing the
headersDistinct and trailersDistinct destination objects.
A plain {} inherits from Object.prototype, so when a __proto__
header is received, dest["__proto__"] resolves to Object.prototype
(truthy), causing _addHeaderLineDistinct to call .push() on it,
which throws an uncaught TypeError and crashes the process.
Ref: https://hackerone.com/reports/3560402
PR-URL: https://github.com/nodejs-private/node-private/pull/821
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2026-21710
This is the same as the original change, minus the `process.emitWarning`
calls and unit tests that expect the deprecation warnings.
Original commit message:
lib: deprecate _tls_common and _tls_wrap
runtime deprecate the _tls_common and _tls_wrap
modules, users should use nust node:tls insteal
and internally internal/tls/commond and
internal/tls/wrap should be used instead
PR-URL: https://github.com/nodejs/node/pull/57643
Backport-PR-URL: https://github.com/nodejs/node/pull/62231
Co-authored-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
Co-authored-by: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <targos@protonmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
WebAssembly is disabled when Node.js is run with --jitless. The
internal TypeScript stripper relies on WebAssembly, and previously
failed obscurely with a ReferenceError in this mode.
This commit adds an explicit check for WebAssembly support when
loading the TypeScript parser. If WebAssembly is unavailable,
it now throws a descriptive ERR_WEBASSEMBLY_NOT_SUPPORTED error.
Fixes: https://github.com/nodejs/node/issues/61353
PR-URL: https://github.com/nodejs/node/pull/61382
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
`fs.globSync` failed with `ENOTDIR` when a path component in a glob
pattern was a file but used as a directory (e.g., 'foo{,/bar}' when
'foo' is a file).
This change aligns `getDirentSync` with the asynchronous `getDirent`
by wrapping the `lstatSync` call in a `try-catch` block to safely
return `null` on such errors.
Fixes: https://github.com/nodejs/node/issues/61257
PR-URL: https://github.com/nodejs/node/pull/61259
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
This particular exception is responsible for a lot of overhead when
debugging with large esm codebases with VS Code and break on caught
exceptions is enabled.
VS Code silently suppresses this exception, but the mechanism it uses
to do so is a bit slow so avoiding this common exception can speed up
loading of esm code.
In my scenario this saved over have of the startup run time
(over 20 seconds).
This should also make debugging without suppression of this exception
more pleasant in other tools such as the Chrome dev tools when
attached to NodeJs processes.
PR-URL: https://github.com/nodejs/node/pull/61000
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
It should remove both the error and the ready event listeners
attached when either of them fires, instead of removing only
the one whose corresponding event fires, otherwise the other
event listener will always get leaked.
PR-URL: https://github.com/nodejs/node/pull/60464
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Previously, formatExtraProperties applied ctx.stylize to the entire
'[key]: value' string. This caused the colon and space to be styled,
making the output inconsistent with normal object properties.
Now, only the key itself is stylized, and the colon and space remain
unstyled, aligning with the formatting of regular properties.
Refs: https://github.com/nodejs/node/pull/60131
PR-URL: https://github.com/nodejs/node/pull/60479
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Previously the addAfterUserSerailizeCallback() wasn't
ready to be used for building the built-in snapshot.
This patch initializes the callbacks at the time
lib/internal/v8/start_snapshot.js is loaded, so that
these callbacks get run correctly when building the
built-in snapshot.
Currently when building the built-in snapshot,
addAfterUserSerializeCallback() is only used by createUnsafeBuffer(),
other usages can only come from user-land snapshots,
which is covered by tests, but what gets run by the
built-in snapshot building process is less visible, and the
path used by createUnsafeBuffer() isn't reliably visible in user
land either. This adds an internal usage counter in debug builds
to verify this path when building the built-in snapshot.
PR-URL: https://github.com/nodejs/node/pull/60434
Fixes: https://github.com/nodejs/node/issues/60423
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
This makes sure special properties (such as a byteLength, buffer,
and more) are marked that they are not regular properties. They
are mostly getters, that just seemed even more of a breaking change.
Thus, they just use square brackets for now.
On top of that, it makes inspecting detached DataViews robust.
Inspecting those failed so far.
PR-URL: https://github.com/nodejs/node/pull/60131
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
- Make sure that the vm.Module.evaluate() method is conditionally
synchronous based on the specification. Previously, the returned
promise is unconditionally pending (even for synthetic modules and
source text modules without top-level await) instead of immediately
fulfilled, making it harder to debug as it deviates from the
specified behavior.
- Clarify the synchronicity of this method in the documentation
- Add more tests for the synchronicity of this method.
PR-URL: https://github.com/nodejs/node/pull/60205
Refs: https://github.com/nodejs/node/issues/59656
Refs: https://github.com/nodejs/node/issues/37648
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
RafaelGSS