$ the-wire · showcase
NODE FIXES STACK OVERFLOW IN RECURSIVE READDIR, PATCHES PERMISSION AUDIT MODE
By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4)
A circular symlink crash in recursive directory traversal just got patched, and permission audit mode finally stops throwing errors when it should only warn.
Node shipped a critical fix for a denial-of-service vector in fs.readdirSync with recursive: true [1]. Circular symlinks would trigger unbounded recursion in the internal walk() helper, exhausting the call stack with RangeError and crashing the process. The existing symlink depth guard didn't protect this code path. Both sync and promise-based variants were vulnerable. In parallel, the permission system got a correctness fix: audit mode was still throwing ERR_ACCESS_DENIED on denied operations instead of just logging warnings [2]. The macros guarding fs, net, child_process, worker, and addon access now respect the warning_only() flag. On the streams side, share() had a buffering regression where the shared buffer could exceed its highWaterMark instead of applying backpressure [3]. These three fixes target real production pain: crashes from symlink traversal, broken audit workflows, and stream buffer overflow.
Action items
- → Patch Node immediately if you use fs.readdirSync with recursive: true nodejs/node [immediate]
- → Test --permission-audit mode if you rely on it for security workflows nodejs/node [plan]
- → Verify share() buffering behavior if you use the streams API nodejs/node [monitor]
References
- [1] vfs: prevent stack overflow in recursive readdir on circular symlinks ↗ nodejs/node
- [2] src,permission: do not throw on denied access in audit mode ↗ nodejs/node
- [3] stream: fix drop-newest behavior in share() ↗ nodejs/node
