node/lib
Matteo Collina 36e29bf400
tls: route callback exceptions through error handlers
Wrap pskCallback and ALPNCallback invocations in try-catch blocks
to route exceptions through owner.destroy() instead of letting them
become uncaught exceptions. This prevents remote attackers from
crashing TLS servers or causing resource exhaustion.

Fixes: https://hackerone.com/reports/3473882
PR-URL: https://github.com/nodejs-private/node-private/pull/782
Backport-PR-URL: https://github.com/nodejs/node/pull/61044
CVE-ID: CVE-2026-21637
Refs: https://github.com/nodejs/node/pull/57643
2026-02-04 15:32:53 +01:00
..
assert
dns
fs
inspector
internal tls: route callback exceptions through error handlers 2026-02-04 15:32:53 +01:00
path
readline
stream
test
timers
util
_http_agent.js http,https: fix double ERR_PROXY_TUNNEL emission 2026-01-19 19:19:04 +01:00
_http_client.js http,https: fix double ERR_PROXY_TUNNEL emission 2026-01-19 19:19:04 +01:00
_http_common.js http: fix rawHeaders exceeding maxHeadersCount limit 2026-01-28 16:29:45 +01:00
_http_incoming.js http: add optimizeEmptyRequests server option 2025-11-18 13:16:31 +01:00
_http_outgoing.js http: lazy allocate cookies array 2025-11-07 18:11:38 +01:00
_http_server.js http: add optimizeEmptyRequests server option 2025-11-18 13:16:31 +01:00
_stream_duplex.js
_stream_passthrough.js
_stream_readable.js
_stream_transform.js
_stream_wrap.js
_stream_writable.js
_tls_common.js lib: backport _tls_common and _tls_wrap refactors 2026-02-04 15:32:52 +01:00
_tls_wrap.js lib: backport _tls_common and _tls_wrap refactors 2026-02-04 15:32:52 +01:00
assert.js lib: update isDeepStrictEqual to support options 2025-09-24 09:03:35 +02:00
async_hooks.js
buffer.js buffer: make methods work on Uint8Array instances 2026-01-27 22:52:31 +01:00
child_process.js
cluster.js
console.js
constants.js
crypto.js
dgram.js lib: use FastBuffer for empty buffer allocation 2026-01-19 19:19:05 +01:00
diagnostics_channel.js diagnostics_channel: fix race condition with diagnostics_channel and GC 2025-09-24 09:03:41 +02:00
dns.js
domain.js
eslint.config_partial.mjs lib: enforce use of URLParse 2026-01-19 19:19:22 +01:00
events.js test: ensure removeListener event fires for once() listeners 2026-02-04 15:32:49 +01:00
fs.js fs: remove duplicate getValidatedPath calls 2026-01-27 22:52:30 +01:00
http.js
http2.js
https.js http,https: handle IPv6 with proxies 2025-09-24 09:03:45 +02:00
inspector.js
module.js
net.js
os.js os: freeze signals constant 2026-01-19 19:19:27 +01:00
path.js
perf_hooks.js perf_hooks: move non-standard performance properties to perf_hooks 2025-11-13 22:44:12 +01:00
process.js
punycode.js lib,src: isInsideNodeModules should test on the first non-internal frame 2026-01-19 19:19:20 +01:00
querystring.js
quic.js
readline.js
repl.js repl: move completion logic to internal module 2026-02-04 15:32:52 +01:00
sea.js
sqlite.js sqlite: cleanup ERM support and export Session class 2025-09-24 09:03:46 +02:00
stream.js stream: export namespace object from internal end-of-stream module 2026-01-28 16:29:45 +01:00
string_decoder.js
sys.js
test.js test_runner: fix lazy test.assert accessor 2026-01-19 19:19:25 +01:00
timers.js lib: remove redundant destroyHook checks 2025-11-07 18:11:13 +01:00
tls.js lib: backport _tls_common and _tls_wrap refactors 2026-02-04 15:32:52 +01:00
trace_events.js
tty.js
url.js lib,src: isInsideNodeModules should test on the first non-internal frame 2026-01-19 19:19:20 +01:00
util.js lib: fix typo in util.js comment 2026-01-27 22:52:30 +01:00
v8.js v8: add GCProfiler support for erm 2026-01-27 22:52:32 +01:00
vm.js
wasi.js
worker_threads.js
zlib.js http2,zlib: prefer call() over apply() if argument list is not array 2026-01-27 22:19:49 +01:00