v5.1.26

MQTT over TLS behind a fronting proxy

The MQTT secure-port UDS metadata published an empty certificate list when a plain TCP port was also registered (#2011). The metadata write read certificates off the wrong server, so a fronting SNI proxy had nothing to select on and fell back to serving the node certificate on 8883. Clients connecting to MQTT over TLS were presented the wrong certificate.

WebSocket upgrades on Unix domain socket listeners

WebSocket upgrades were silently dropped on the per-worker UDS mirror listeners (#2019). With tls.unixDomainSockets enabled, the per-worker UDS mirror is a separate http.Server that never received the 'upgrade' listener onWebSocket() attaches to the port-keyed server. Node destroys an upgrade socket that has no 'upgrade' listener — with no response and no log entry — so every WebSocket handshake arriving on the mirror failed silently, with nothing on either side to diagnose it. getHTTPServer() now exposes the mirror and onWebSocket() attaches the same upgrade dispatch to it.

The same change stops enableProxyProtocol()'s data interception from outliving the PROXY header decision. The wrapper kept forwarding post-upgrade frames to the HTTP parser it captured at connection time; once the connection upgraded, that parser was freed and could be reissued by the parser pool to an unrelated connection, which then received another connection's WebSocket frames. This was reproduced as cross-connection corruption. The wrapper now removes itself and restores the original 'data' listeners as soon as the header decision resolves.

Also in this release

Regression coverage for the UDS certificate-metadata and WebSocket-over-UDS paths.