node/lib at v25.8.2 - node - Gitea: Git with a cup of tea

mirrors/node

0 Fork 0

mirror of https://github.com/nodejs/node.git synced 2026-10-29 02:35:20 +08:00

Files

T

History

Matteo Collina 86c04784dd http: use null prototype for headersDistinct/trailersDistinct

Use { __proto__: null } instead of {} when initializing the
headersDistinct and trailersDistinct destination objects.

A plain {} inherits from Object.prototype, so when a __proto__
header is received, dest["__proto__"] resolves to Object.prototype
(truthy), causing _addHeaderLineDistinct to call .push() on it,
which throws an uncaught TypeError and crashes the process.

Ref: https://hackerone.com/reports/3560402
PR-URL: https://github.com/nodejs-private/node-private/pull/821
Refs: https://hackerone.com/reports/3560402
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
CVE-ID: CVE-2026-21710

2026-03-20 15:07:18 -03:00

..

assert: add assert/strict alias module

2020-06-25 08:37:48 -07:00

dns: make promise API fully constructed from lib/internal/dns/promises

2022-06-20 19:58:45 +01:00

fs: add fs/promises alias module

2020-02-18 22:15:50 -08:00

lib: revert to using default derived class constructors

2025-08-30 14:28:10 +00:00

tls: wrap SNICallback invocation in try/catch

2026-03-20 15:07:12 -03:00

path: add path/posix and path/win32 alias modules

2020-10-20 14:27:31 +00:00

lib: revert to using default derived class constructors

2025-08-30 14:28:10 +00:00

stream: add bytes() method to stream/consumers

2026-02-02 14:02:18 +01:00

test_runner: do not expose internal loader

2024-08-13 15:17:50 +02:00

lib: remove unnecessary optional chaining

2024-11-07 15:59:12 +00:00

util: add util/types alias module

2020-10-21 01:26:34 +02:00

_http_agent.js

http: add http.setGlobalProxyFromEnv()

2026-01-13 10:04:44 -03:00

_http_client.js

http: validate ClientRequest path on set

2026-03-02 20:18:53 +00:00

_http_common.js

http: fix use-after-free when freeParser is called during llhttp_execute

2026-03-10 14:48:53 +01:00

_http_incoming.js

http: use null prototype for headersDistinct/trailersDistinct

2026-03-20 15:07:18 -03:00

_http_outgoing.js

http: lazy allocate cookies array

2025-10-27 15:07:04 +01:00

_http_server.js

http: validate headers in writeEarlyHints

2026-03-02 14:41:03 +00:00

_stream_duplex.js

lib: add module to use in module deprecation warnings

2025-05-26 14:39:25 +00:00

_stream_passthrough.js

lib: add module to use in module deprecation warnings

2025-05-26 14:39:25 +00:00

_stream_readable.js

lib: add module to use in module deprecation warnings

2025-05-26 14:39:25 +00:00

_stream_transform.js

lib: add module to use in module deprecation warnings

2025-05-26 14:39:25 +00:00

_stream_wrap.js

lib: add module to use in module deprecation warnings

2025-05-26 14:39:25 +00:00

_stream_writable.js

lib: add module to use in module deprecation warnings

2025-05-26 14:39:25 +00:00

_tls_common.js

lib: add module to use in module deprecation warnings

2025-05-26 14:39:25 +00:00

_tls_wrap.js

lib: add module to use in module deprecation warnings

2025-05-26 14:39:25 +00:00

assert.js

lib: prefer call() over apply() if argument list is not array

2026-01-13 10:04:20 -03:00

async_hooks.js

async_hooks: add trackPromises option to createHook()

2026-01-28 19:35:56 +01:00

buffer.js

buffer: optimize buffer.concat performance

2026-02-28 12:07:22 +01:00

child_process.js

lib: use validators for argument validation

2025-09-21 02:47:14 +00:00

cluster.js

cluster: use ObjectPrototypeHasOwnProperty

2023-05-25 16:04:19 +00:00

console.js

console: split console into global.js and constructor.js

2018-12-02 04:51:18 +08:00

constants.js

lib: flatten access to primordials

2019-11-25 10:28:15 +01:00

crypto.js

crypto: support ML-KEM, DHKEM, and RSASVE key encapsulation mechanisms

2025-08-20 14:30:58 +00:00

dgram.js

lib: prefer call() over apply() if argument list is not array

2026-01-13 10:04:20 -03:00

diagnostics_channel.js

src: add C++ support for diagnostics channels

2026-02-28 12:07:00 +01:00

dns.js

dns: move falsy hostname in lookup to end-of-life

2025-06-13 12:47:23 +00:00

domain.js

domain: remove deprecated API call

2025-08-05 03:51:16 +00:00

eslint.config_partial.mjs

lib: enforce use of URLParse

2026-01-13 10:04:48 -03:00

events.js

events: don't call resume after close

2026-02-19 11:14:01 +01:00

fs.js

fs: add throwIfNoEntry option for fs.stat and fs.promises.stat

2026-02-19 11:14:00 +01:00

http2.js

http2: add server handshake utility

2024-01-12 16:09:48 +00:00

http.js

http: add http.setGlobalProxyFromEnv()

2026-01-13 10:04:44 -03:00

https.js

http: add http.setGlobalProxyFromEnv()

2026-01-13 10:04:44 -03:00

inspector.js

inspector: initial support storage inspection

2026-01-25 00:07:50 +01:00

module.js

lib: allow skipping source maps in node_modules

2025-01-23 22:44:10 +00:00

net.js

tls: forward keepAlive, keepAliveInitialDelay, noDelay to socket

2026-03-02 14:34:55 +00:00

os.js

os: freeze signals constant

2026-01-13 10:04:51 -03:00

path.js

path: refactor path joining logic for clarity and performance

2025-09-08 18:44:18 +00:00

perf_hooks.js

perf_hooks: move non-standard performance properties to perf_hooks

2025-11-05 23:05:00 +01:00

process.js

src: disambiguate terms used to refer to builtins and addons

2022-08-09 01:36:49 +08:00

punycode.js

lib,src: isInsideNodeModules should test on the first non-internal frame

2026-01-13 10:04:44 -03:00

querystring.js

meta: enable jsdoc/check-tag-names rule

2025-07-18 09:28:21 +00:00

quic.js

quic: continue working on quic api bits

2025-10-07 14:04:53 +00:00

readline.js

lib: prefer logical assignment

2024-10-09 06:42:16 +00:00

repl.js

repl: keep reference count for process.on('newListener')

2026-02-28 12:06:51 +01:00

sea.js

sea: implement sea.getAssetKeys()

2025-09-04 11:58:50 +00:00

sqlite.js

sqlite: mark as release candidate

2026-02-22 01:07:46 +01:00

stream.js

stream: export namespace object from internal end-of-stream module

2026-01-25 00:07:50 +01:00

string_decoder.js

meta: enable jsdoc/check-tag-names rule

2025-07-18 09:28:21 +00:00

sys.js

lib: add node: prefix in sys module deprecation warning

2025-05-26 14:39:25 +00:00

test.js

test_runner: fix lazy test.assert accessor

2026-01-13 10:04:50 -03:00

timers.js

lib: remove redundant destroyHook checks

2025-10-08 12:11:43 +00:00

tls.js

tls: only do off-thread certificate loading on loading tls

2025-09-18 18:54:14 +00:00

trace_events.js

trace_events: use private fields instead of symbols for Tracing

2023-12-28 23:20:22 +00:00

tty.js

tty: initialize winSize array with values

2024-08-11 06:32:13 +00:00

url.js

url: suppress warnings from url.format/url.resolve inside node_modules

2026-03-10 20:20:07 +01:00

util.js

lib: optimize styleText when validateStream is false

2026-02-19 11:14:06 +01:00

v8.js

v8: changing total_allocated_bytes to avoid ABI changes

2026-01-24 01:49:17 +01:00

vm.js

lib: add validation for options in compileFunction

2024-12-06 06:53:06 +00:00

wasi.js

lib: expose setupInstance method on WASI class

2025-07-07 08:41:16 -07:00

worker_threads.js

worker: add name for worker

2025-08-05 13:45:41 +00:00

zlib.js

zlib: add support for brotli compression dictionary

2026-02-19 11:14:02 +01:00