Matteo Collina [Tue, 17 Feb 2026 13:26:17 +0000 (14:26 +0100)]
tls: wrap SNICallback invocation in try/catch
Wrap the owner._SNICallback() invocation in loadSNI() with try/catch
to route exceptions through owner.destroy() instead of letting them
become uncaught exceptions. This completes the fix from CVE-2026-21637
which added try/catch protection to callALPNCallback,
onPskServerCallback, and onPskClientCallback but missed loadSNI().
Without this fix, a remote unauthenticated attacker can crash any
Node.js TLS server whose SNICallback may throw on unexpected input
by sending a single TLS ClientHello with a crafted server_name value.
Matteo Collina [Mon, 22 Dec 2025 17:25:33 +0000 (18:25 +0100)]
tls: route callback exceptions through error handlers
Wrap pskCallback and ALPNCallback invocations in try-catch blocks
to route exceptions through owner.destroy() instead of letting them
become uncaught exceptions. This prevents remote attackers from
crashing TLS servers or causing resource exhaustion.
RafaelGSS [Tue, 17 Dec 2024 19:58:03 +0000 (16:58 -0300)]
src: fix HTTP2 mem leak on premature close and ERR_PROTO
This commit fixes a memory leak when the socket is
suddenly closed by the peer (without GOAWAY notification)
and when invalid header (by nghttp2) is identified and the
connection is terminated by peer.
Refs: https://hackerone.com/reports/2841362
PR-URL: https://github.com/nodejs-private/node-private/pull/650 Reviewed-By: James M Snell <jasnell@gmail.com>
CVE-ID: CVE-2025-23085
origin: https://github.com/nodejs/node/commit/6cc8d58e6f97c37c228f134bd9b98246c8871fb1
src: rethrow stack overflow exceptions in async_hooks When a stack overflow exception occurs during async_hooks callbacks (which use TryCatchScope::kFatal), detect the specific "Maximum call stack size exceeded" RangeError and re-throw it instead of immediately calling FatalException. This allows user code to catch the exception with try-catch blocks instead of requiring uncaughtException handlers.
The implementation adds IsStackOverflowError() helper to detect stack
overflow RangeErrors and re-throws them in TryCatchScope destructor
instead of calling FatalException.
This fixes the issue where async_hooks would cause stack overflow
exceptions to exit with code 7 (kExceptionInFatalExceptionHandler)
instead of being catchable.
Fixes: #37989
Ref: https://hackerone.com/reports/3456295
PR-URL: nodejs-private/node-private#773
Refs: https://hackerone.com/reports/3456295 Reviewed-By: Robert Nagy <ronagy@icloud.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>
CVE-ID: CVE-2025-59466
origin: backport, https://github.com/nodejs/node/commit/d7a5c587c02ebe18f9fe4de986bac55d80c2868f
bug: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#uncatchable-maximum-call-stack-size-exceeded-error-on-nodejs-via-async_hooks-leads-to-process-crashes-bypassing-error-handlers-cve-2025-59466---medium
RafaelGSS [Fri, 31 Oct 2025 19:27:48 +0000 (16:27 -0300)]
lib: add TLSSocket default error handler
This prevents the server from crashing due to an unhandled rejection
when a TLSSocket connection is abruptly destroyed during initialization
and the user has not attached an error handler to the socket.
e.g:
src,lib: refactor unsafe buffer creation to remove zero-fill toggle
This removes the zero-fill toggle mechanism that allowed JavaScript
to control ArrayBuffer initialization via shared memory. Instead,
unsafe buffer creation now uses a dedicated C++ API.
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1792647
Bug-Debian: https://bugs.debian.org/909011 Reviewed-by: dod
The downstream 'path_max' patch in Debian sets the buffer size
for readlink() to the 'st_size' value obtained with lstat().
However, it might be zero for some symlinks in /proc on Linux
(notably /proc/self) leading to readlink() failing with EINVAL.
* run tests with ./node
* remove addons from test-ci suite, because it creates a dependency loop
nodejs -> node-gyp -> nodejs which is painful to manage.
* disabled because it requires stdin:
+ test-stdout-close-unref
+ test-regress-GH-746
* test-tick-processor fails on ppc64 and s390x, currently investigated
https://github.com/nodejs/node/issues/2471
* test-cluster-disconnect sometimes fails on busy buildd, forwarded upstream
https://github.com/nodejs/node/issues/3383
* test-fs-watch is flaky, might be related to https://github.com/nodejs/node/issues/4082
* huge timeout value for all platforms, buildd could be busy
* test-npm-install and test-release-npm must fail, debian package dfsg-repacked npm out
* ability to override CI_NATIVE_SUITES, CI_JS_SUITES
* disable tests failing because DNS is disabled
* sequential/test-http2-session-timeout is flaky https://github.com/nodejs/node/issues/20628
If the default security level is overwritten at build time of openssl
then it is needed to lower it again for nodejs in order to pass the
testsuite because it is using smoil keys.
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Gbp-Pq: Topic build
Gbp-Pq: Name openssl_config_explicit_lower.patch
* Team upload
* Fix CVE-2025-23085:
A memory leak could occur when a remote peer abruptly closes
the socket without sending a GOAWAY notification. Additionally,
if an invalid header was detected by nghttp2, causing the
connection to be terminated by the peer, the same leak was
triggered. This flaw could lead to increased memory consumption
and potential denial of service under certain conditions
(Closes: #1094134)
* Fix CVE-2025-23166:
The C++ method SignTraits::DeriveBits() may incorrectly call
ThrowException() based on user-supplied inputs when executing
in a background thread, crashing the Node.js process.
Such cryptographic operations are commonly applied to
untrusted inputs. Thus, this mechanism potentially allows
an adversary to remotely crash a Node.js runtime.
(Closes: #1105832)
* Fix CVE-2025-55131:
A flaw in Node.js's buffer allocation logic can expose uninitialized
memory when allocations are interrupted, when using the `vm` module
with the timeout option. Under specific timing conditions, buffers
allocated with `Buffer.alloc` and other `TypedArray` instances like
`Uint8Array` may contain leftover data from previous operations,
allowing in-process secrets like tokens or passwords to leak or
causing data corruption. While exploitation typically requires precise
timing or in-process code execution, it can become remotely
exploitable when untrusted input influences workload and timeouts,
leading to potential confidentiality and integrity impact.
* Fix CVE-2025-59465:
A malformed `HTTP/2 HEADERS` frame with oversized, invalid
`HPACK` data can cause Node.js to crash by triggering an
unhandled `TLSSocket` error `ECONNRESET`. Instead of safely
closing the connection, the process crashes, enabling a remote
denial of service. This primarily affects applications that
do not attach explicit error handlers to secure sockets,
for example: ``` server.on('secureConnection', socket =>
{ socket.on('error', err => { console.log(err) }) }) ```
* Fix CVE-2025-59466:
async_hooks would cause stack overflow
exceptions to exit with code 7 (kExceptionInFatalExceptionHandler)
instead of being catchable.
When a stack overflow exception occurs during async_hooks callbacks
(which use TryCatchScope::kFatal), detect the specific "Maximum call
stack size exceeded" RangeError and re-throw it instead of immediately
calling FatalException. This allows user code to catch the exception
with try-catch blocks instead of requiring uncaughtException handlers.
* Fix CVE-2025-23166:
A flaw in Node.js TLS error handling allows remote attackers to crash
or exhaust resources of a TLS server when `pskCallback` or
`ALPNCallback` are in use. Synchronous exceptions thrown during these
callbacks bypass standard TLS error handling paths (tlsClientError and
error), causing either immediate process termination or silent file
descriptor leaks that eventually lead to denial of service. Because
these callbacks process attacker-controlled input during the TLS
handshake, a remote client can repeatedly trigger the issue. This
vulnerability affects TLS servers using PSK or ALPN callbacks across.
* Fix CVE-2026-21710:
A flaw in Node.js HTTP request handling causes an uncaught `TypeError`
when a request is received with a header named `__proto__` and the
application accesses `req.headersDistinct`. When this occurs,
`dest["__proto__"]` resolves to `Object.prototype` rather than
`undefined`, causing `.push()` to be called on a non-array. This
exception is thrown synchronously inside a property getter and cannot
be intercepted by `error` event listeners, meaning it cannot be
handled without wrapping every `req.headersDistinct` access in a
`try/catch`
* Fix CVE-2026-21713:
A flaw in Node.js HMAC verification uses a non-constant-time
comparison when validating user-provided signatures, potentially
leaking timing information proportional to the number of matching
bytes. Under certain threat models where high-resolution timing
measurements are possible, this behavior could be exploited as a
timing oracle to infer HMAC values. Node.js already provides
timing-safe comparison primitives used elsewhere in the codebase,
indicating this is an oversight rather than an intentional design
decision.
* Fix CVE-2026-21714:
A memory leak occurs in Node.js HTTP/2 servers when a client sends
WINDOW_UPDATE frames on stream 0 (connection-level) that cause the
flow control window to exceed the maximum value of 2³¹-1. The server
correctly sends a GOAWAY frame, but the Http2Session object is never
cleaned up.
projects / nodejs.git / log