Changelog

nodejs/node · · 26 commits

Security fixes and FFI wins land

Node tightens crypto, URL, SQLite, and WebIDL safety while adding FFI callable caching and faster trampoline placement.

Archkon trivikr panva greenheadHQ aduh95 adamjmcgrath pimterry bmuenzenmeyer kyungrae2002 ndossche luanmuniz trivenay hallss93

FFI now reuses function wrappers and trims trampoline probing (trivikrbf2f995, trivikr51a55d4)

DynamicLibrary.getFunction() now caches and reuses the callable created for a symbol instead of rebuilding a new wrapper on every access, fixing identity churn and a serious leak under repeated accessor use. The native trampoline placement search window was also shrunk from 1024 to 16 pages per direction, cutting failed probe syscalls and reducing symbol-resolution latency.

RSA-OAEP gains separate MGF1 hashing support (adamjmcgrath11423b1)

Node now accepts mgf1Hash alongside oaepHash, letting OAEP and MGF1 use different digests when needed. This updates the JS API, native crypto plumbing, typings, and adds dedicated coverage for the new behavior.

WebCrypto and Web IDL hardening against prototype pollution (panvae04663a, panva4758184)

WebCrypto internals now read BufferSource inputs and lookup tables through primordials/safe helpers, closing prototype-pollution paths in key import and related crypto flows. The WebIDL dictionary converter was also hardened to copy member descriptors once and avoid inherited property lookups.

HTTP request reuse now preserves backpressure semantics (trivenay0700e74)

When the HTTP agent reuses a pooled socket for a request with a different highWaterMark, it now synchronizes the socket's writable HWM to match the new request. _flush() also emits drain correctly after handing buffered data to a socket that never actually backpressured, fixing stalled write loops.

TLS, DTLS, and QUIC certificate handling is consolidated (pimterrye79c6b3)

Certificate-store and private-key handling were refactored into shared helpers used across TLS, DTLS, and QUIC. This reduces duplicated logic and makes CA/CRL/private-key behavior consistent across the three stacks.

Several security and correctness fixes (trivikrb2b7405, Archkon8f51878, Archkonbc6db3e, Archkonabbf086, Archkonee5a070, ndossche330f7b5, Archkonf6db7bc, Archkonab9afa9)

This batch includes SQLite callback-state protection, safer SEA argv/asset/config parsing, a Windows file-URL bounds check, NULL-return handling in SQLite value extraction, a task-runner ComSpec fix, and a guard on process resource-stat array offsets. Together they close edge-case crashes, misparses, and memory-safety hazards.

Other misc changes

  • SQLite serialize/deserialize docs and tests updated (trivikrb2b7405)
  • WebCrypto prototype-pollution test adjusted for [EnforceRange] (panva8c8190f)
  • Commit-queue workflow/token handling tweaks (aduh952b7766e, aduh9521b2880)
  • Benchmarks added for node:test hooks/options and FFI getFunction resolution (luanmuniz3458dea, trivikr51a55d4)
  • Documentation fixes for URLs, permissions, crypto randomFill, and internal links (bmuenzenmeyer45ecaad, kyungrae200265a0265, greenheadHQ84b76c8, greenheadHQd846ffd)
  • Minor stream/TLS helper cleanup via validateArray (greenheadHQe6fa5bf)
  • QUIC status/header typing and related test updates (hallss93cbe18d8)
  • SQLite and URL regression tests added for the fixes above (ndossche330f7b5, Archkonee5a070)