Wrap the owner._SNICallback() invocation in loadSNI() with try/catch
to route exceptions through owner.destroy() instead of letting them
become uncaught exceptions. This completes the fix from CVE-2026-21637
which added try/catch protection to callALPNCallback,
onPskServerCallback, and onPskClientCallback but missed loadSNI().
Without this fix, a remote unauthenticated attacker can crash any
Node.js TLS server whose SNICallback may throw on unexpected input
by sending a single TLS ClientHello with a crafted server_name value.
Fixes: https://hackerone.com/reports/3556769
Refs: https://hackerone.com/reports/3473882
CVE-ID: CVE-2026-21637
PR-URL: https://github.com/nodejs-private/node-private/pull/819
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2026-21637
Use { __proto__: null } instead of {} when initializing the
headersDistinct and trailersDistinct destination objects.
A plain {} inherits from Object.prototype, so when a __proto__
header is received, dest["__proto__"] resolves to Object.prototype
(truthy), causing _addHeaderLineDistinct to call .push() on it,
which throws an uncaught TypeError and crashes the process.
Ref: https://hackerone.com/reports/3560402
PR-URL: https://github.com/nodejs-private/node-private/pull/821
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2026-21710
`parallel/test-strace-openat-openssl` was added to check explicitly
for a list of known files that would be opened for a set workload
(`require("crypto")`). This is not reliable when Node.js is linked
to an external/shared OpenSSL library (e.g. it might be configured
to load configuration files from a different default location and/or
load more than one configuration file) so skip this test when Node.js
is built in that way.
PR-URL: https://github.com/nodejs/node/pull/61987
Fixes: https://github.com/nodejs/node/issues/61966
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
`fs.globSync` failed with `ENOTDIR` when a path component in a glob
pattern was a file but used as a directory (e.g., 'foo{,/bar}' when
'foo' is a file).
This change aligns `getDirentSync` with the asynchronous `getDirent`
by wrapping the `lstatSync` call in a `try-catch` block to safely
return `null` on such errors.
Fixes: https://github.com/nodejs/node/issues/61257
PR-URL: https://github.com/nodejs/node/pull/61259
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
Recent architectures like RISC-V does not support open syscall,
which will cause strace to fail and thus test failure.
AssertionError [ERR_ASSERTION]: strace: invalid system call 'open'
This patch disables tracing open syscall for RISC-V in the test to fix
the test failure.
PR-URL: https://github.com/nodejs/node/pull/60588
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
It should remove both the error and the ready event listeners
attached when either of them fires, instead of removing only
the one whose corresponding event fires, otherwise the other
event listener will always get leaked.
PR-URL: https://github.com/nodejs/node/pull/60464
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
After the write triggers a restart of the grandchild, the newly
spawned second grandchild can post another 'script ready' message
before the stdout from the first grandchild is relayed by the
watcher and processed by this parent process to kill
the watcher. If we write again and trigger another restart, we can
end up in an infinite loop and never receive the stdout of the
grandchildren in time.
Only write once to verify the first grandchild process receives
the expected signal. We don't care about the subsequent grandchild
processes.
PR-URL: https://github.com/nodejs/node/pull/60443
Refs: https://github.com/nodejs/node/issues/60297
Refs: https://github.com/nodejs/node/pull/60391
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Darshan Sen <raisinten@gmail.com>
Previously, formatExtraProperties applied ctx.stylize to the entire
'[key]: value' string. This caused the colon and space to be styled,
making the output inconsistent with normal object properties.
Now, only the key itself is stylized, and the colon and space remain
unstyled, aligning with the formatting of regular properties.
Refs: https://github.com/nodejs/node/pull/60131
PR-URL: https://github.com/nodejs/node/pull/60479
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Previously the addAfterUserSerailizeCallback() wasn't
ready to be used for building the built-in snapshot.
This patch initializes the callbacks at the time
lib/internal/v8/start_snapshot.js is loaded, so that
these callbacks get run correctly when building the
built-in snapshot.
Currently when building the built-in snapshot,
addAfterUserSerializeCallback() is only used by createUnsafeBuffer(),
other usages can only come from user-land snapshots,
which is covered by tests, but what gets run by the
built-in snapshot building process is less visible, and the
path used by createUnsafeBuffer() isn't reliably visible in user
land either. This adds an internal usage counter in debug builds
to verify this path when building the built-in snapshot.
PR-URL: https://github.com/nodejs/node/pull/60434
Fixes: https://github.com/nodejs/node/issues/60423
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
This makes sure special properties (such as a byteLength, buffer,
and more) are marked that they are not regular properties. They
are mostly getters, that just seemed even more of a breaking change.
Thus, they just use square brackets for now.
On top of that, it makes inspecting detached DataViews robust.
Inspecting those failed so far.
PR-URL: https://github.com/nodejs/node/pull/60131
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
- Make sure that the vm.Module.evaluate() method is conditionally
synchronous based on the specification. Previously, the returned
promise is unconditionally pending (even for synthetic modules and
source text modules without top-level await) instead of immediately
fulfilled, making it harder to debug as it deviates from the
specified behavior.
- Clarify the synchronicity of this method in the documentation
- Add more tests for the synchronicity of this method.
PR-URL: https://github.com/nodejs/node/pull/60205
Refs: https://github.com/nodejs/node/issues/59656
Refs: https://github.com/nodejs/node/issues/37648
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
RafaelGSS