Matteo Collina 7dafafa242 dns,net: reject hostnames with embedded NUL bytes ...

Refs: https://hackerone.com/reports/3656716
PR-URL: https://github.com/nodejs-private/node-private/pull/868
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48930

2026-06-18 06:29:24 +02:00

..

assert

…

dns

…

fs

…

inspector

lib: revert to using default derived class constructors

2025-08-30 14:28:10 +00:00

internal

dns,net: reject hostnames with embedded NUL bytes

2026-06-18 06:29:24 +02:00

path

…

readline

lib: revert to using default derived class constructors

2025-08-30 14:28:10 +00:00

stream

stream: add stream/iter to classic stream adapters

2026-04-06 09:59:56 -07:00

test

test_runner: do not expose internal loader

2024-08-13 15:17:50 +02:00

timers

lib: remove unnecessary optional chaining

2024-11-07 15:59:12 +00:00

util

…

zlib

stream: add stream/iter Implementation

2026-03-27 19:55:08 -07:00

_http_agent.js

http: add http.setGlobalProxyFromEnv()

2025-12-10 16:12:28 +00:00

_http_client.js

http: add httpValidation option to configure header value validation

2026-05-30 08:10:58 +00:00

_http_common.js

http: add httpValidation option to configure header value validation

2026-05-30 08:10:58 +00:00

_http_incoming.js

http: make req.headers have a null prototype

2026-04-25 09:28:53 +00:00

_http_outgoing.js

http: add httpValidation option to configure header value validation

2026-05-30 08:10:58 +00:00

_http_server.js

http: add httpValidation option to configure header value validation

2026-05-30 08:10:58 +00:00

_tls_common.js

lib: add module to use in module deprecation warnings

2025-05-26 14:39:25 +00:00

_tls_wrap.js

lib: add module to use in module deprecation warnings

2025-05-26 14:39:25 +00:00

assert.js

lib: prefer call() over apply() if argument list is not array

2025-11-23 08:45:46 +00:00

async_hooks.js

async_hooks: add trackPromises option to createHook()

2026-01-28 11:25:24 +00:00

buffer.js

buffer: optimize Buffer.prototype.copy

2026-06-12 23:26:19 +00:00

child_process.js

lib: handle --permission-audit when propagating flags

2026-05-06 19:21:11 +00:00

cluster.js

…

console.js

…

constants.js

…

crypto.js

crypto: implement randomUUIDv7()

2026-04-05 10:12:21 +00:00

dgram.js

dgram: add synchronous Socket connectSync()

2026-06-17 19:09:05 +00:00

diagnostics_channel.js

lib: add lint rule to enforce use of kEmptyObject

2026-06-10 10:56:56 +00:00

dns.js

dns,net: reject hostnames with embedded NUL bytes

2026-06-18 06:29:24 +02:00

domain.js

repl: remove dependency on domain module

2026-03-06 15:38:36 +00:00

dtls.js

lib: apply minor dtls cleanups

2026-05-31 12:49:51 -07:00

eslint.config_partial.mjs

lib: add Iterator global to primordials

2026-06-13 17:31:16 +00:00

events.js

tools: enforce iterator result property order

2026-05-26 17:19:42 +00:00

ffi.js

ffi: add experimental fast FFI call API for AArch64 and x86_64

2026-06-16 09:35:02 +00:00

fs.js

fs: support caller-supplied readFile() buffers

2026-06-13 10:08:05 +00:00

http2.js

…

http.js

http: add http.setGlobalProxyFromEnv()

2025-12-10 16:12:28 +00:00

https.js

http: add http.setGlobalProxyFromEnv()

2025-12-10 16:12:28 +00:00

inspector.js

inspector: initial support storage inspection

2026-01-23 14:51:48 +00:00

module.js

lib: allow skipping source maps in node_modules

2025-01-23 22:44:10 +00:00

net.js

dns,net: reject hostnames with embedded NUL bytes

2026-06-18 06:29:24 +02:00

os.js

os: freeze signals constant

2025-12-22 16:14:46 +00:00

path.js

path: refactor path joining logic for clarity and performance

2025-09-08 18:44:18 +00:00

perf_hooks.js

perf_hooks: move non-standard performance properties to perf_hooks

2025-10-28 00:23:50 +01:00

process.js

…

punycode.js

lib,src: isInsideNodeModules should test on the first non-internal frame

2025-12-10 13:59:35 +00:00

querystring.js

meta: enable jsdoc/check-tag-names rule

2025-07-18 09:28:21 +00:00

quic.js

quic: fix broken listEndpoints export, test callbacks & nghttp3 include

2026-06-14 13:06:39 +00:00

readline.js

lib: prefer logical assignment

2024-10-09 06:42:16 +00:00

repl.js

lib: add lint rule to enforce use of kEmptyObject

2026-06-10 10:56:56 +00:00

sea.js

sea: implement sea.getAssetKeys()

2025-09-04 11:58:50 +00:00

sqlite.js

sqlite: mark as release candidate

2026-02-21 16:30:23 +00:00

stream.js

stream: export namespace object from internal end-of-stream module

2026-01-23 11:47:27 +00:00

string_decoder.js

meta: enable jsdoc/check-tag-names rule

2025-07-18 09:28:21 +00:00

sys.js

lib: add node: prefix in sys module deprecation warning

2025-05-26 14:39:25 +00:00

test.js

test_runner: add getTestContext()

2026-04-01 10:09:41 +00:00

timers.js

lib: remove redundant destroyHook checks

2025-10-08 12:11:43 +00:00

tls.js

tls: normalize hostname for server identity checks

2026-06-18 06:29:23 +02:00

trace_events.js

…

tty.js

tty: initialize winSize array with values

2024-08-11 06:32:13 +00:00

url.js

url: suppress warnings from url.format/url.resolve inside node_modules

2026-03-08 18:32:29 +00:00

util.js

lib: add lint rule to enforce use of kEmptyObject

2026-06-10 10:56:56 +00:00

v8.js

v8: add cpu profile options

2026-04-26 19:36:36 +00:00

vfs.js

vfs: add minimal node:vfs subsystem

2026-05-23 18:43:31 +00:00

vm.js

lib: add lint rule to enforce use of kEmptyObject

2026-06-10 10:56:56 +00:00

wasi.js

lib: add lint rule to enforce use of kEmptyObject

2026-06-10 10:56:56 +00:00

worker_threads.js

worker: add name for worker

2025-08-05 13:45:41 +00:00

zlib.js

zlib: coerce -0 to +0 for crc32 seeds

2026-05-31 14:25:31 +00:00