Matteo Collina [Tue, 9 Dec 2025 22:50:18 +0000 (23:50 +0100)]
[PATCH] src: rethrow stack overflow exceptions in async_hooks
When a stack overflow exception occurs during async_hooks callbacks
(which use TryCatchScope::kFatal), detect the specific "Maximum call
stack size exceeded" RangeError and re-throw it instead of immediately
calling FatalException. This allows user code to catch the exception
with try-catch blocks instead of requiring uncaughtException handlers.
The implementation adds IsStackOverflowError() helper to detect stack
overflow RangeErrors and re-throws them in TryCatchScope destructor
instead of calling FatalException.
This fixes the issue where async_hooks would cause stack overflow
exceptions to exit with code 7 (kExceptionInFatalExceptionHandler)
instead of being catchable.
Fixes: https://github.com/nodejs/node/issues/37989
Ref: https://hackerone.com/reports/3456295
PR-URL: https://github.com/nodejs-private/node-private/pull/773
Refs: https://hackerone.com/reports/3456295 Reviewed-By: Robert Nagy <ronagy@icloud.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>
CVE-ID: CVE-2025-59466
Gbp-Pq: Topic sec
Gbp-Pq: Name 37-rethrow-stack-overflow-exceptions-in-async-hooks.patch
RafaelGSS [Fri, 31 Oct 2025 19:27:48 +0000 (16:27 -0300)]
[PATCH] lib: add TLSSocket default error handler
This prevents the server from crashing due to an unhandled rejection
when a TLSSocket connection is abruptly destroyed during initialization
and the user has not attached an error handler to the socket.
e.g:
Matteo Collina [Mon, 22 Dec 2025 17:25:33 +0000 (18:25 +0100)]
[PATCH] tls: route callback exceptions through error handlers
Wrap pskCallback and ALPNCallback invocations in try-catch blocks
to route exceptions through owner.destroy() instead of letting them
become uncaught exceptions. This prevents remote attackers from
crashing TLS servers or causing resource exhaustion.
Tobias Nießen [Mon, 18 Aug 2025 12:17:47 +0000 (14:17 +0200)]
[PATCH] src: fix order of CHECK_NOT_NULL/dereference
`ASYNC_THROW_IF_INSUFFICIENT_PERMISSIONS` may dereference
`req_wrap_async`, so `CHECK_NOT_NULL(req_wrap_async)` should be used
before and not after.
PR-URL: https://github.com/nodejs/node/pull/59487 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Gbp-Pq: Topic sec
Gbp-Pq: Name 29-fix-order-of-check-not-null.patch
[loong64][codegen] Avoid memory access under stack pointer
According to LoongArch ABI doc chapter 8.2:
"Procedures must not assume the persistence on-stack data of which
the addresses lie below the stack pointer."
[PATCH] v8: fix missing callback in heap utils destroy
This fixes the v8.getHeapSnapshot() calls not properly being
destroyed. Pipeline calls would for example not properly end
without the callback being in place.
Eusgor [Thu, 29 May 2025 20:01:48 +0000 (02:01 +0600)]
[PATCH] src: fix possible dereference of null pointer
There is a CHECK_NOT_NULL check before dereferencing node_env on
line 710 in the "if" block, but there is no CHECK_NOT_NULL check before
dereferencing node_env on line 721. Maybe it makes sense to put
CHECK_NOT_NULL right after calling the Environment::GetCurrent function.
PR-URL: https://github.com/nodejs/node/pull/58459 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Michael Dawson <midawson@redhat.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Gbp-Pq: Topic sec
Gbp-Pq: Name 17-fix-possible-dereference-of-null-pointer.patch
The function AllocForBrotli prefixes the allocated memory with its
size, and returns a pointer to the region after it. This pointer can
however no longer be suitably aligned. Correct this by allocating
the maximum of the the size of the size_t and the max alignment.
On Arm 32bits the size_t is 4 bytes long, but the alignment is 8 for
some NEON instructions. When Brotli is compiled with optimizations
enabled newer GCC versions will use the NEON instructions and trigger
a bus error killing node.
see https://github.com/google/brotli/issues/1159
PR-URL: https://github.com/nodejs/node/pull/57727 Reviewed-By: Shelley Vohr <shelley.vohr@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Daniel Lemire <daniel@lemire.me> Reviewed-By: Gerhard Stöbich <deb2001-github@yahoo.de>
Gbp-Pq: Topic sec
Gbp-Pq: Name 10-zlib-fix-pointer-alignment.patch
it fails on IPv6-only systems. Setting it with libc fails on linux.
https://github.com/nodejs/node/issues/33279
https://lists.debian.org/debian-devel/2023/12/msg00011.html
Gbp-Pq: Topic deps
Gbp-Pq: Name localhost-no-addrconfig.patch
* Upstream security patches:
+ CVE-2025-23085: follow-up fix wrong check for NGHTTP2_GOAWAY
+ CVE-2026-21637: TLS error handling allows remote attackers to
crash or exhaust resources of a TLS server when `pskCallback`
or `ALPNCallback` are in use.
+ CVE-2025-59465: malformed `HTTP/2 HEADERS` frame with oversized
invalid `HPACK` data can cause a crash.
+ CVE-2025-55132: permission model allows a file's access and
modification timestamps to be changed via `futimes()` even when
the process has only read permissions.
+ CVE-2025-55130: permissions model allows attackers to bypass
`--allow-fs-read` and `--allow-fs-write` restrictions using
crafted relative symlink paths.
+ CVE-2025-59466: "Maximum call stack size exceeded" errors become
uncatchable when `async_hooks.createHook()` is enabled.
+ CVE-2025-55131: buffer allocation logic can expose uninitialized
memory when allocations are interrupted, when using the `vm` module
with the timeout option.
* Upstream critical fixes (see sec/NN patches)
+ zlib: fix pointer alignment (10)
+ os: fix GetInterfaceAddresses memory leak (15)
+ src: fix possible dereference of null pointers (17, 29)
+ v8: fix missing callback in heap utils destroy (19)
+ v8: loong64 - avoid memory access under stack pointer (27)
+ http2: do not crash on mismatched ping buffer length (28)
+ v8: riscv64 - Fix sp handling in MacroAssembler::LeaveFrame (44)
projects / nodejs.git / log