$ the-wire · showcase
Node crypto reset across snapshots, Brotli and permission-model CVEs land in the security queue
By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology
11 people shipped this
Filip Skokan
@panva
1 cited
RafaelGSS
@RafaelGSS
1 cited
mcollina
@mcollina
1 cited
isHeSatoshi
@isHeSatoshi
1 cited
mrityunjay-pandey
@mrityunjay-pandey
1 cited
Antoine du Hamel
@aduh95
Evgenii Kliuchnikov
@eustas
James M Snell
@jasnell
RlxChap2
@RlxChap2
Node.js GitHub Bot
@nodejs-github-bot
github-actions
@github-actions
A batch of private-landed fixes covering three CVEs and a snapshot random-value leak dominates the day, while undici closes two crash-class bugs in HTTP/2 stream teardown and the sqlite cache.
crypto: reset random caches across snapshots nodejs/node
Startup snapshots retained unused randomInt() and UUID cache entries, so a deserialized process could replay the same random values it had generated before serialization. The fix clears the caches after user serialization callbacks and before user deserialization callbacks, which also catches caches refilled by microtasks, next ticks, or exit handlers.
permission: check permission model in realpathSync nodejs/node
fs.realpathSync() did not consult the permission model, while fs.realpathSync.native(), fs.promises.realpath(), fs.lstatSync(), and fs.existsSync() already denied the same paths. The fix closes that gap under CVE-2026-106073; a sibling change fixes the fs permission tree node on wildcard nodes for CVE-2026-106071.
fix(http2): keep persistent error sink on released streams nodejs/undici
When an HTTP/2 session was torn down with an error, such as the idle reaper in onHttp2SessionIdleTimeout, a released stream with no 'error' listener crashed the process with an unhandled "InformationalError: socket idle timeout". releaseRequestStream, severRequestStream, and releaseUpgradeStream had only installed a one-shot once('error', noop) sink; they now keep a persistent sink.
fix(cache): ignore SQLITE_BUSY in the sqlite cache store nodejs/undici
SqliteCacheStore did not tolerate SQLite contention: when another connection wrote the same database file, node:sqlite threw ERR_SQLITE_ERROR with errcode 5 ("database is locked") and that error escaped get(), set(), delete(), and the pruning that set() performs. The fix ignores SQLITE_BUSY, which matters for any store shared across processes.
fix: let interim 1xx responses through DecoratorHandler nodejs/undici
Interim 1xx responses such as 103 Early Hints reach onResponseStart before the final response, and DecoratorHandler asserted it was only called once, failing requests with ERR_ASSERTION for handlers built on it, including the dns interceptor's DNSDispatchHandler. Later in the tail: FormData.prototype methods are now declared as methods so TypeScript subclasses can override them, the Brotli deco...
Action items
- → Upgrade Node.js to a release containing the CVE-2026-106073 realpathSync permission fix and CVE-2026-106071 wildcard ... nodejs/node [immediate]
- → Upgrade Node.js to a release containing the snapshot crypto cache reset for randomInt() and UUID values nodejs/node [immediate]
- → Update undici past the HTTP/2 released-stream error sink fix if you run HTTP/2 with idle timeouts nodejs/undici [plan]
