src: handle null backing store in ArrayBufferViewContents::Read by mertcanaltin · Pull Request #62343 · nodejs/node

mertcanaltin · 2026-03-19T20:46:04Z

added fallback stack_storage for null scenario

codecov · 2026-03-19T23:03:00Z

Codecov Report

❌ Patch coverage is 66.66667% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 89.69%. Comparing base (0998c37) to head (7d46389).
⚠️ Report is 53 commits behind head on main.

Files with missing lines	Patch %	Lines
src/util-inl.h	66.66%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #62343      +/-   ##
==========================================
- Coverage   91.60%   89.69%   -1.91%     
==========================================
  Files         337      676     +339     
  Lines      140741   206695   +65954     
  Branches    21797    39579   +17782     
==========================================
+ Hits       128923   185398   +56475     
- Misses      11594    13438    +1844     
- Partials      224     7859    +7635

Files with missing lines	Coverage Δ
src/util-inl.h	`82.35% <66.66%> (ø)`

... and 459 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

panva

With ArrayBufferViewContents being used broadly throughout node's codebase I wonder if we can be sure this is entirely without side effects. I cannot assess that.

That being said, it does fix the particular node:crypto issue reported.

mertcanaltin · 2026-03-20T06:51:26Z

With ArrayBufferViewContents being used broadly throughout node's codebase I wonder if we can be sure this is entirely without side effects. I cannot assess that.

That being said, it does fix the particular node:crypto issue reported.

I went through all 19 files that use ArrayBufferViewContents, every usage passes data() alongside length(), and none dereferences the pointer when length is 0. Currently data_ can already be null in this scenario, this fix just ensures it's a valid pointer instead, so it's strictly safer than the current behavior.

panva · 2026-03-20T08:52:08Z

I went through all 19 files that use ArrayBufferViewContents, every usage passes data() alongside length(), and none dereferences the pointer when length is 0. Currently data_ can already be null in this scenario, this fix just ensures it's a valid pointer instead, so it's strictly safer than the current behavior.

Very well, can you update the commit message to src: handle null backing store in ArrayBufferViewContents::Read?

mertcanaltin · 2026-03-20T10:12:25Z

I went through all 19 files that use ArrayBufferViewContents, every usage passes data() alongside length(), and none dereferences the pointer when length is 0. Currently data_ can already be null in this scenario, this fix just ensures it's a valid pointer instead, so it's strictly safer than the current behavior.

Very well, can you update the commit message to src: handle null backing store in ArrayBufferViewContents::Read?

sure, edited thanks

src/util-inl.h

Fixes: nodejs#62342 src: handle null backing store in ArrayBufferViewContents::Read

mcollina

lgtm

nodejs-github-bot · 2026-03-28T14:43:21Z

CI: https://ci.nodejs.org/job/node-test-pull-request/72141/

nodejs-github-bot · 2026-03-29T01:46:14Z

CI: https://ci.nodejs.org/job/node-test-pull-request/72176/

nodejs-github-bot · 2026-03-29T11:56:03Z

Landed in bdf75a6

When ABVC receives a view on an array buffer with a null data pointer, it sets its own data pointer to uninitialized stack memory. While V8 _should_ always have the view length set to zero in this case, it's worth double-checking. Refs: nodejs#62343

Fixes: nodejs#62342 src: handle null backing store in ArrayBufferViewContents::Read PR-URL: nodejs#62343 Fixes: nodejs#62342 Reviewed-By: René <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Matteo Collina <[email protected]>

Fixes: #62342 src: handle null backing store in ArrayBufferViewContents::Read PR-URL: #62343 Fixes: #62342 Reviewed-By: René <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Matteo Collina <[email protected]>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | minor | `25.8.2` → `25.9.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v25.9.0`](https://github.com/nodejs/node/releases/tag/v25.9.0): 2026-04-01, Version 25.9.0 (Current), @aduh95 [Compare Source](nodejs/node@v25.8.2...v25.9.0) ##### Notable Changes ##### Test runner module mocking improvements `MockModuleOptions.defaultExport` and `MockModuleOptions.namedExports` have been consolidated into a single option `MockModuleOptions.exports` to align with user expectations and other test runners. A `default` property on `MockModuleOptions.exports` represents the default export, and own enumerable properties are treated as named exports. An automated migration is available to update user code: <https://github.com/nodejs/userland-migrations/tree/main/recipes/mock-module-exports> ```bash npx codemod @nodejs/mock-module-exports ``` Contributed by sangwook in [#61727](nodejs/node#61727). ##### Other notable changes - \[[`312476cb84`](nodejs/node@312476cb84)] - **(SEMVER-MINOR)** **async\_hooks**: add using scopes to `AsyncLocalStorage` (Stephen Belanger) [#61674](nodejs/node#61674) - \[[`62d2cd473b`](nodejs/node@62d2cd473b)] - **(SEMVER-MINOR)** **cli**: add `--max-heap-size` option (tannal) [#58708](nodejs/node#58708) - \[[`d0ebf0e44b`](nodejs/node@d0ebf0e44b)] - **(SEMVER-MINOR)** **crypto**: add `TurboSHAKE` and `KangarooTwelve` Web Cryptography algorithms (Filip Skokan) [#62183](nodejs/node#62183) - \[[`f85b9d9fa8`](nodejs/node@f85b9d9fa8)] - **(SEMVER-MINOR)** **repl**: add customizable error handling (Anna Henningsen) [#62188](nodejs/node#62188) - \[[`67b854d407`](nodejs/node@67b854d407)] - **(SEMVER-MINOR)** **repl**: remove dependency on `node:domain` (Matteo Collina) [#61227](nodejs/node#61227) - \[[`966b700623`](nodejs/node@966b700623)] - **(SEMVER-MINOR)** **sea**: support code cache for ESM entrypoint in SEA (Joyee Cheung) [#62158](nodejs/node#62158) - \[[`e1f0d2a014`](nodejs/node@e1f0d2a014)] - **(SEMVER-MINOR)** **stream**: add stream/iter Implementation (James M Snell) [#62066](nodejs/node#62066) ##### Commits - \[[`312476cb84`](nodejs/node@312476cb84)] - **(SEMVER-MINOR)** **async\_hooks**: add using scopes to AsyncLocalStorage (Stephen Belanger) [#61674](nodejs/node#61674) - \[[`bfff8cb2ab`](nodejs/node@bfff8cb2ab)] - **(SEMVER-MINOR)** **benchmark**: add benchmarks for experimental stream/iter (James M Snell) [#62066](nodejs/node#62066) - \[[`c721d68502`](nodejs/node@c721d68502)] - **benchmark**: fix destructuring in dgram/single-buffer (Ali Hassan) [#62084](nodejs/node#62084) - \[[`e2f03c8e92`](nodejs/node@e2f03c8e92)] - **buffer**: improve performance of multiple Buffer operations (Ali Hassan) [#61871](nodejs/node#61871) - \[[`2fcd07f1ba`](nodejs/node@2fcd07f1ba)] - **build**: support empty libname flags in `configure.py` (Antoine du Hamel) [#62477](nodejs/node#62477) - \[[`b800c57fce`](nodejs/node@b800c57fce)] - **build**: fix timezone-update path references (Chengzhong Wu) [#62280](nodejs/node#62280) - \[[`7dc5a1e9b4`](nodejs/node@7dc5a1e9b4)] - **build**: skip dockit on IBMi (SRAVANI GUNDEPALLI) [#62189](nodejs/node#62189) - \[[`f0eea0f905`](nodejs/node@f0eea0f905)] - **build**: fix --node-builtin-modules-path (Filip Skokan) [#62115](nodejs/node#62115) - \[[`62d2cd473b`](nodejs/node@62d2cd473b)] - **(SEMVER-MINOR)** **cli**: add --max-heap-size option (tannal) [#58708](nodejs/node#58708) - \[[`ac4b485698`](nodejs/node@ac4b485698)] - **crypto**: update root certificates to NSS 3.121 (Node.js GitHub Bot) [#62485](nodejs/node#62485) - \[[`d0ebf0e44b`](nodejs/node@d0ebf0e44b)] - **(SEMVER-MINOR)** **crypto**: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) [#62183](nodejs/node#62183) - \[[`3009980d9d`](nodejs/node@3009980d9d)] - **crypto**: add crypto::GetSSLCtx API for addon access to OpenSSL contexts (Tim Perry) [#62254](nodejs/node#62254) - \[[`f5725ca81d`](nodejs/node@f5725ca81d)] - **crypto**: reject ML-KEM/ML-DSA [PKCS#8](https://github.com/PKCS/node/issues/8) import without seed in SubtleCrypto (Filip Skokan) [#62218](nodejs/node#62218) - \[[`f69ed4bc3f`](nodejs/node@f69ed4bc3f)] - **crypto**: rename CShakeParams and KmacParams length to outputLength (Filip Skokan) [#61875](nodejs/node#61875) - \[[`4d96e53570`](nodejs/node@4d96e53570)] - **crypto**: refactor WebCrypto AEAD algorithms auth tag handling (Filip Skokan) [#62169](nodejs/node#62169) - \[[`93d77719e8`](nodejs/node@93d77719e8)] - **crypto**: read algorithm name property only once in normalizeAlgorithm (Filip Skokan) [#62170](nodejs/node#62170) - \[[`3d2e23a981`](nodejs/node@3d2e23a981)] - **deps**: update ada to 3.4.4 (Node.js GitHub Bot) [#62414](nodejs/node#62414) - \[[`176d6d2205`](nodejs/node@176d6d2205)] - **deps**: update timezone to 2026a (Node.js GitHub Bot) [#62164](nodejs/node#62164) - \[[`95c7fc67ba`](nodejs/node@95c7fc67ba)] - **deps**: update googletest to [`2461743`](nodejs/node@2461743) (Node.js GitHub Bot) [#62484](nodejs/node#62484) - \[[`e5e9f2044a`](nodejs/node@e5e9f2044a)] - **deps**: update simdjson to 4.5.0 (Node.js GitHub Bot) [#62382](nodejs/node#62382) - \[[`905b94266a`](nodejs/node@905b94266a)] - **deps**: update ngtcp2 to 1.21.0 (Node.js GitHub Bot) [#62051](nodejs/node#62051) - \[[`180c150122`](nodejs/node@180c150122)] - **deps**: V8: cherry-pick [`cf1bce4`](nodejs/node@cf1bce40a5ef) (Richard Lau) [#62449](nodejs/node#62449) - \[[`bc265aa003`](nodejs/node@bc265aa003)] - **deps**: upgrade npm to 11.12.1 (npm team) [#62448](nodejs/node#62448) - \[[`f1b28612c4`](nodejs/node@f1b28612c4)] - **deps**: V8: cherry-pick [`b25cd62`](nodejs/node@b25cd62c7ba2) (Yagiz Nizipli) [#62354](nodejs/node#62354) - \[[`757719d2af`](nodejs/node@757719d2af)] - **deps**: disable rust icu compiled\_data features (Chengzhong Wu) [#62284](nodejs/node#62284) - \[[`3bdc955b63`](nodejs/node@3bdc955b63)] - **deps**: update sqlite to 3.51.3 (Node.js GitHub Bot) [#62256](nodejs/node#62256) - \[[`a9703d194a`](nodejs/node@a9703d194a)] - **deps**: update googletest to [`73a63ea`](nodejs/node@73a63ea) (Node.js GitHub Bot) [#61927](nodejs/node#61927) - \[[`85138935cb`](nodejs/node@85138935cb)] - **deps**: update merve to 1.2.2 (Node.js GitHub Bot) [#62213](nodejs/node#62213) - \[[`231521e75e`](nodejs/node@231521e75e)] - **diagnostics\_channel**: add diagnostics channels for web locks (Ilyas Shabi) [#62123](nodejs/node#62123) - \[[`0093863664`](nodejs/node@0093863664)] - **doc**: deprecate `module.register()` (DEP0205) (Geoffrey Booth) [#62395](nodejs/node#62395) - \[[`0b96ece6be`](nodejs/node@0b96ece6be)] - **doc**: clarify that features cannot be both experimental and deprecated (Antoine du Hamel) [#62456](nodejs/node#62456) - \[[`8d3ea975f5`](nodejs/node@8d3ea975f5)] - **doc**: fix 'transfered' typo in quic.md (lilianakatrina684-a11y) [#62492](nodejs/node#62492) - \[[`08ff16e0ba`](nodejs/node@08ff16e0ba)] - **doc**: move sqlite type conversion section to correct level (René) [#62482](nodejs/node#62482) - \[[`61cc747dd8`](nodejs/node@61cc747dd8)] - **doc**: add Rafael to last security release steward (Rafael Gonzaga) [#62423](nodejs/node#62423) - \[[`64cfa5a6fa`](nodejs/node@64cfa5a6fa)] - **doc**: use npm-published version of doc-kit (Aviv Keller) [#62139](nodejs/node#62139) - \[[`1020321fb0`](nodejs/node@1020321fb0)] - **doc**: fix overstated Date header requirement in response.sendDate (Kit Dallege) [#62206](nodejs/node#62206) - \[[`9caa7855b2`](nodejs/node@9caa7855b2)] - **doc**: fix guaranteed typo (lilianakatrina684-a11y) [#62374](nodejs/node#62374) - \[[`e254f65306`](nodejs/node@e254f65306)] - **doc**: enhance clarification about the main field (Mowafak Almahaini) [#62302](nodejs/node#62302) - \[[`9e724b53f8`](nodejs/node@9e724b53f8)] - **doc**: remove spawn with shell example from bat/cmd section (Kit Dallege) [#62243](nodejs/node#62243) - \[[`7f37c17516`](nodejs/node@7f37c17516)] - **doc**: minor typo fix (Jeff Matson) [#62358](nodejs/node#62358) - \[[`eb0ca98f01`](nodejs/node@eb0ca98f01)] - **doc**: add path to vulnerabilities.json mention (Rafael Gonzaga) [#62355](nodejs/node#62355) - \[[`198b6e0932`](nodejs/node@198b6e0932)] - **doc**: deprecate CryptoKey use in node:crypto (Filip Skokan) [#62321](nodejs/node#62321) - \[[`17e5aee6c5`](nodejs/node@17e5aee6c5)] - **doc**: fix small environment\_variables typo (chris) [#62279](nodejs/node#62279) - \[[`193d629895`](nodejs/node@193d629895)] - **doc**: test and test-only targets do not run linter (Xavier Stouder) [#62120](nodejs/node#62120) - \[[`4a1f20ec4a`](nodejs/node@4a1f20ec4a)] - **doc**: clarify fs.ReadStream and fs.WriteStream are not constructable (Kit Dallege) [#62208](nodejs/node#62208) - \[[`f976c9214d`](nodejs/node@f976c9214d)] - **doc**: clarify that any truthy value of `shell` is part of DEP0190 (Antoine du Hamel) [#62249](nodejs/node#62249) - \[[`4d83972681`](nodejs/node@4d83972681)] - **doc**: remove outdated Chrome 66 and ndb references from debugger (Kit Dallege) [#62202](nodejs/node#62202) - \[[`71f2eada5b`](nodejs/node@71f2eada5b)] - **doc**: add throwIfNoEntry version history to fs.stat (kovan) [#62204](nodejs/node#62204) - \[[`670c80893b`](nodejs/node@670c80893b)] - **doc**: add note (and caveat) for `mock.module` about customization hooks (Jacob Smith) [#62075](nodejs/node#62075) - \[[`2ff5cb13f5`](nodejs/node@2ff5cb13f5)] - **doc,test**: clarify --eval syntax for leading '-' scripts (kovan) [#62244](nodejs/node#62244) - \[[`6c6c9004c4`](nodejs/node@6c6c9004c4)] - **esm**: fix typo in worker loader hook comment (jakecastelli) [#62475](nodejs/node#62475) - \[[`1cdd23c9f3`](nodejs/node@1cdd23c9f3)] - **esm**: fix source phase identity bug in loadCache eviction (Guy Bedford) [#62415](nodejs/node#62415) - \[[`4f4ff15794`](nodejs/node@4f4ff15794)] - **esm**: fix path normalization in `finalizeResolution` (Antoine du Hamel) [#62080](nodejs/node#62080) - \[[`088167d102`](nodejs/node@088167d102)] - **events**: avoid cloning listeners array on every emit (Gürgün Dayıoğlu) [#62261](nodejs/node#62261) - \[[`0250b436ee`](nodejs/node@0250b436ee)] - **fs**: fix cpSync to handle non-ASCII characters (Stefan Stojanovic) [#61950](nodejs/node#61950) - \[[`b67a8fb171`](nodejs/node@b67a8fb171)] - **inspector**: add Target.getTargets and extract TargetManager (Kohei) [#62487](nodejs/node#62487) - \[[`ffcc5a5722`](nodejs/node@ffcc5a5722)] - **lib**: make SubtleCrypto.supports enumerable (Filip Skokan) [#62307](nodejs/node#62307) - \[[`92ef2ad8fa`](nodejs/node@92ef2ad8fa)] - **lib**: prefer primordials in SubtleCrypto (Filip Skokan) [#62226](nodejs/node#62226) - \[[`40a43ac4d0`](nodejs/node@40a43ac4d0)] - **module**: fix coverage of mocked CJS modules imported from ESM (Marco) [#62133](nodejs/node#62133) - \[[`3ef0a5b90e`](nodejs/node@3ef0a5b90e)] - **quic**: remove CryptoKey support from session keys option (Filip Skokan) [#62335](nodejs/node#62335) - \[[`3c8dd8eb8e`](nodejs/node@3c8dd8eb8e)] - **repl**: use vm DONT\_CONTEXTIFY context (Chengzhong Wu) [#62371](nodejs/node#62371) - \[[`f85b9d9fa8`](nodejs/node@f85b9d9fa8)] - **(SEMVER-MINOR)** **repl**: add customizable error handling (Anna Henningsen) [#62188](nodejs/node#62188) - \[[`e4c164e045`](nodejs/node@e4c164e045)] - **repl**: handle exceptions from async context after close (Anna Henningsen) [#62165](nodejs/node#62165) - \[[`67b854d407`](nodejs/node@67b854d407)] - **(SEMVER-MINOR)** **repl**: remove dependency on domain module (Matteo Collina) [#61227](nodejs/node#61227) - \[[`966b700623`](nodejs/node@966b700623)] - **(SEMVER-MINOR)** **sea**: support code cache for ESM entrypoint in SEA (Joyee Cheung) [#62158](nodejs/node#62158) - \[[`fe82baf970`](nodejs/node@fe82baf970)] - **src**: improve EC JWK import performance (Filip Skokan) [#62396](nodejs/node#62396) - \[[`d490b171e0`](nodejs/node@d490b171e0)] - **src**: handle null backing store in ArrayBufferViewContents::Read (Mert Can Altin) [#62343](nodejs/node#62343) - \[[`0e4af848bc`](nodejs/node@0e4af848bc)] - **src**: convert context\_frame field in AsyncWrap to internal field (Anna Henningsen) [#62103](nodejs/node#62103) - \[[`02980b8c8f`](nodejs/node@02980b8c8f)] - **src**: enable compilation/linking with OpenSSL 4.0 (Filip Skokan) [#62410](nodejs/node#62410) - \[[`064f7c2fa6`](nodejs/node@064f7c2fa6)] - **src**: use stack allocation in indexOf latin1 path (Mert Can Altin) [#62268](nodejs/node#62268) - \[[`ede52bc2dc`](nodejs/node@ede52bc2dc)] - **src,sqlite**: fix filterFunc dangling reference (Edy Silva) [#62281](nodejs/node#62281) - \[[`e1f0d2a014`](nodejs/node@e1f0d2a014)] - **(SEMVER-MINOR)** **stream**: add stream/iter Implementation (James M Snell) [#62066](nodejs/node#62066) - \[[`03839fb087`](nodejs/node@03839fb087)] - **stream**: preserve error over AbortError in pipeline (Marco) [#62113](nodejs/node#62113) - \[[`0000d2f011`](nodejs/node@0000d2f011)] - **stream**: replace bind with arrow function for onwrite callback (Ali Hassan) [#62087](nodejs/node#62087) - \[[`3796a73719`](nodejs/node@3796a73719)] - **test**: update WPT for WebCryptoAPI to [`2cb332d`](nodejs/node@2cb332d710) (Node.js GitHub Bot) [#62483](nodejs/node#62483) - \[[`ad8309415b`](nodejs/node@ad8309415b)] - **test**: update WPT for url to [`fc3e651`](nodejs/node@fc3e651593) (Node.js GitHub Bot) [#62379](nodejs/node#62379) - \[[`bed89b037e`](nodejs/node@bed89b037e)] - **test**: wait for reattach before initial break on restart (Yuya Inoue) [#62471](nodejs/node#62471) - \[[`c9ffffcc55`](nodejs/node@c9ffffcc55)] - **test**: disable flaky WPT Blob test on AIX (James M Snell) [#62470](nodejs/node#62470) - \[[`fd41ef31f6`](nodejs/node@fd41ef31f6)] - **(SEMVER-MINOR)** **test**: add tests for experimental stream/iter implementation (James M Snell) [#62066](nodejs/node#62066) - \[[`1b9d8d3eec`](nodejs/node@1b9d8d3eec)] - **test**: avoid flaky run wait in debugger restart test (Yuya Inoue) [#62112](nodejs/node#62112) - \[[`cb08a29d51`](nodejs/node@cb08a29d51)] - **test**: skip test-cluster-dgram-reuse on AIX 7.3 (Stewart X Addison) [#62238](nodejs/node#62238) - \[[`abea0af8a9`](nodejs/node@abea0af8a9)] - **test**: add WebCrypto Promise.prototype.then pollution regression tests (Filip Skokan) [#62226](nodejs/node#62226) - \[[`47a2132269`](nodejs/node@47a2132269)] - **test**: update WPT for WebCryptoAPI to [`6a1c545`](nodejs/node@6a1c545d77) (Node.js GitHub Bot) [#62187](nodejs/node#62187) - \[[`2c63d3006c`](nodejs/node@2c63d3006c)] - **test\_runner**: add exports option for module mocks (sangwook) [#61727](nodejs/node#61727) - \[[`44ac0e1302`](nodejs/node@44ac0e1302)] - **test\_runner**: make it compatible with fake timers (Matteo Collina) [#59272](nodejs/node#59272) - \[[`1865691275`](nodejs/node@1865691275)] - **test\_runner**: set non-zero exit code when suite errors occur (Edy Silva) [#62282](nodejs/node#62282) - \[[`0252b2bab8`](nodejs/node@0252b2bab8)] - **tools**: bump picomatch from 4.0.3 to 4.0.4 in /tools/eslint (dependabot\[bot]) [#62439](nodejs/node#62439) - \[[`3368155267`](nodejs/node@3368155267)] - **tools**: bump yaml from 2.8.2 to 2.8.3 in /tools/doc (dependabot\[bot]) [#62437](nodejs/node#62437) - \[[`5e47c359f5`](nodejs/node@5e47c359f5)] - **tools**: adopt the `--check-for-duplicates` NCU flag (Antoine du Hamel) [#62478](nodejs/node#62478) - \[[`4a604e82d0`](nodejs/node@4a604e82d0)] - **tools**: bump picomatch in /tools/doc (dependabot\[bot]) [#62438](nodejs/node#62438) - \[[`d1a98b4ddb`](nodejs/node@d1a98b4ddb)] - **tools**: bump flatted from 3.4.1 to 3.4.2 in /tools/eslint (dependabot\[bot]) [#62375](nodejs/node#62375) - \[[`c32daa1ab4`](nodejs/node@c32daa1ab4)] - **tools**: bump eslint deps (Huáng Jùnliàng) [#62356](nodejs/node#62356) - \[[`7a2fcc6d41`](nodejs/node@7a2fcc6d41)] - **tools**: do not swallow error in `lint-nix` workflow (Antoine du Hamel) [#62292](nodejs/node#62292) - \[[`c41a2871b5`](nodejs/node@c41a2871b5)] - **tools**: add eslint-plugin-regexp (Huáng Jùnliàng) [#62093](nodejs/node#62093) - \[[`56dfeb06df`](nodejs/node@56dfeb06df)] - **tools**: fix timeout errors in `lint-nix` job (Antoine du Hamel) [#62265](nodejs/node#62265) - \[[`22fc8078e8`](nodejs/node@22fc8078e8)] - **tools**: bump flatted from 3.3.3 to 3.4.1 in /tools/eslint (dependabot\[bot]) [#62255](nodejs/node#62255) - \[[`409b0663bd`](nodejs/node@409b0663bd)] - **tools**: bump undici from 6.23.0 to 6.24.1 in /tools/doc (dependabot\[bot]) [#62250](nodejs/node#62250) - \[[`67c69750f4`](nodejs/node@67c69750f4)] - **tools**: validate all commits that are pushed to `main` (Antoine du Hamel) [#62246](nodejs/node#62246) - \[[`7d9db8cd21`](nodejs/node@7d9db8cd21)] - **tools**: keep GN files when updating Merve (Antoine du Hamel) [#62167](nodejs/node#62167) - \[[`6c8fa42ba2`](nodejs/node@6c8fa42ba2)] - **typings**: rationalise TypedArray types (René) [#62174](nodejs/node#62174) - \[[`531c64d04e`](nodejs/node@531c64d04e)] - **url**: enable simdutf for ada (Yagiz Nizipli) [#61477](nodejs/node#61477) - \[[`2000caccde`](nodejs/node@2000caccde)] - **util**: allow color aliases in styleText (sangwook) [#62180](nodejs/node#62180) - \[[`0aed332ab4`](nodejs/node@0aed332ab4)] - **wasm**: support js string constant esm import (Guy Bedford) [#62198](nodejs/node#62198) - \[[`d3fd4a978b`](nodejs/node@d3fd4a978b)] - **worker**: heap profile optimizations (Ilyas Shabi) [#62201](nodejs/node#62201) - \[[`e992a34a18`](nodejs/node@e992a34a18)] - **zlib**: fix use-after-free when reset() is called during write (Matteo Collina) [#62325](nodejs/node#62325) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

Fixes: nodejs#62342 src: handle null backing store in ArrayBufferViewContents::Read PR-URL: nodejs#62343 Fixes: nodejs#62342 Reviewed-By: René <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Matteo Collina <[email protected]>

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. labels Mar 19, 2026

mertcanaltin mentioned this pull request Mar 19, 2026

cipher.update() fails for CCM mode with zero-length ArrayBufferView backed by explicit ArrayBuffer #62342

Closed

mertcanaltin force-pushed the mert/fix/ccm-zero-length-dataview branch from 664507a to 88f8f03 Compare March 19, 2026 20:58

panva reviewed Mar 20, 2026

View reviewed changes

panva approved these changes Mar 20, 2026

View reviewed changes

mertcanaltin force-pushed the mert/fix/ccm-zero-length-dataview branch from 88f8f03 to 8104939 Compare March 20, 2026 10:11

panva changed the title ~~src: ccm cipher update with zero-length dataView~~ src: handle null backing store in ArrayBufferViewContents::Read Mar 20, 2026

panva approved these changes Mar 20, 2026

View reviewed changes

panva added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. request-ci Add this label to start a Jenkins CI on a PR. labels Mar 20, 2026

addaleax approved these changes Mar 20, 2026

View reviewed changes

Renegade334 approved these changes Mar 20, 2026

View reviewed changes

src/util-inl.h Outdated Show resolved Hide resolved

mertcanaltin force-pushed the mert/fix/ccm-zero-length-dataview branch 3 times, most recently from cf77348 to 71b8c2a Compare March 20, 2026 20:58

src: handle null backing store in ArrayBufferViewContents::Read

7d46389

Fixes: nodejs#62342 src: handle null backing store in ArrayBufferViewContents::Read

mertcanaltin force-pushed the mert/fix/ccm-zero-length-dataview branch from 71b8c2a to 7d46389 Compare March 20, 2026 21:18

mcollina approved these changes Mar 21, 2026

View reviewed changes

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Mar 26, 2026

This comment was marked as outdated.

Sign in to view

mcollina added the commit-queue Add this label to land a pull request using GitHub Actions. label Mar 29, 2026

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Mar 29, 2026

nodejs-github-bot merged commit bdf75a6 into nodejs:main Mar 29, 2026
62 of 63 checks passed

github-actions bot mentioned this pull request Mar 29, 2026

[Vulnerability] nodejs/node: Null Pointer Dereference / Process Crash spaceraccoon/vulnerability-spoiler-alert#124

Open

Renegade334 added lts-watch-v20.x PRs that may need to be released in v20.x lts-watch-v22.x PRs that may need to be released in v22.x lts-watch-v24.x PRs that may need to be released in v24.x labels Mar 29, 2026

github-actions bot mentioned this pull request Mar 31, 2026

2026-04-01, Version 25.9.0 (Current) #62522

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

src: handle null backing store in ArrayBufferViewContents::Read#62343

src: handle null backing store in ArrayBufferViewContents::Read#62343
nodejs-github-bot merged 1 commit intonodejs:mainfrom
mertcanaltin:mert/fix/ccm-zero-length-dataview

mertcanaltin commented Mar 19, 2026 •

edited by Renegade334

Loading

Uh oh!

codecov bot commented Mar 19, 2026 •

edited

Loading

Uh oh!

panva left a comment

Uh oh!

mertcanaltin commented Mar 20, 2026 •

edited

Loading

Uh oh!

panva commented Mar 20, 2026

Uh oh!

mertcanaltin commented Mar 20, 2026

Uh oh!

Uh oh!

mcollina left a comment

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

nodejs-github-bot commented Mar 28, 2026

Uh oh!

nodejs-github-bot commented Mar 29, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented Mar 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Conversation

mertcanaltin commented Mar 19, 2026 • edited by Renegade334 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

panva left a comment

Choose a reason for hiding this comment

Uh oh!

mertcanaltin commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

panva commented Mar 20, 2026

Uh oh!

mertcanaltin commented Mar 20, 2026

Uh oh!

Uh oh!

mcollina left a comment

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

nodejs-github-bot commented Mar 28, 2026

Uh oh!

nodejs-github-bot commented Mar 29, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented Mar 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

mertcanaltin commented Mar 19, 2026 •

edited by Renegade334

Loading

codecov bot commented Mar 19, 2026 •

edited

Loading

mertcanaltin commented Mar 20, 2026 •

edited

Loading