-
Notifications
You must be signed in to change notification settings - Fork 20
Node v24.17.0 nsolid v6.3.1 release #482
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
santigimeno
merged 22 commits into
node-v24.x-nsolid-v6.x
from
node-v24.17.0-nsolid-v6.3.1-release
Jun 23, 2026
Merged
Changes from all commits
Commits
Show all changes
22 commits
Select commit
Hold shift + click to select a range
f95bedd
Working on v24.16.1
aduh95 cf44df3
deps: update undici to 7.28.0
nodejs-github-bot 3a631e7
deps: fix aix implicit declaration in OpenSSL
abmusse 684bae5
deps: upgrade openssl sources to openssl-3.5.7
nodejs-github-bot dd627ce
deps: update archs files for openssl-3.5.7
nodejs-github-bot 66e6203
deps: update nghttp2 to 1.69.0
nodejs-github-bot a8a0d12
deps: fix integration issues with the latest nghttp2
pimterry cb2aed9
deps: update llhttp to 9.4.2
aduh95 9224427
lib,test: redact proxy credentials in tunnel errors
mcollina a1bbc24
permission: handle process.chdir on writereport
RafaelGSS 8e75c73
tls: normalize hostname for server identity checks
mcollina cc7c11b
http2: cap originSet size to prevent unbounded memory growth
mcollina 31beb4f
tls: fix case-sensitive SNI context matching
mcollina 138c702
dns,net: reject hostnames with embedded NUL bytes
mcollina cf85d54
permission: disable FileHandle utimes with permission model
RafaelGSS be7e719
http: fix response queue poisoning in http.Agent
mcollina 9e4dfc7
crypto: guard WebCrypto cipher output length
panva a77af48
tls: bind reusable sessions to authenticated host
mcollina e3723ff
test: add session reuse host verification regressions
mcollina 413e874
2026-06-18, Version 24.17.0 'Krypton' (LTS)
aduh95 3398eac
Merge tag 'v24.17.0' into node-v24.17.0-nsolid-v6.3.1-release
santigimeno 59f5719
2026-06-18, Version 24.17.0-nsolid-v6.3.1 'Krypton'
santigimeno File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: nodesource/nsolid
Length of output: 31777
🏁 Script executed:
Repository: nodesource/nsolid
Length of output: 1111
🏁 Script executed:
Repository: nodesource/nsolid
Length of output: 2162
🏁 Script executed:
Repository: nodesource/nsolid
Length of output: 2468
🏁 Script executed:
Repository: nodesource/nsolid
Length of output: 1186
🏁 Script executed:
Repository: nodesource/nsolid
Length of output: 1608
🏁 Script executed:
Repository: nodesource/nsolid
Length of output: 2148
🏁 Script executed:
Repository: nodesource/nsolid
Length of output: 480
🏁 Script executed:
Repository: nodesource/nsolid
Length of output: 327
The validation at line 6347 compares
origin_lenagainst the total frame length rather than available payload bytes.When a frame contains only the 2-byte
origin_lenheader plus N bytes of payload, the checkorigin_len > iframe->payloadleft(wherepayloadleft == frame.hd.length) allowsorigin_lenvalues up to the total frame size. However, onlyframe.hd.length - 2bytes are available for the origin field, causing the pointer arithmetic at line 767 to overflow whenorigin_len > (frame.hd.length - 2).Additionally, the zero-payload fast path (lines 754–760) bypasses validation of the
origin_lenfield entirely and unconditionally initializes it to zero without checking whether a non-zeroorigin_lenwas encoded in the frame header.The validation at line 6347 should check
origin_len > (iframe->payloadleft - 2), and the zero-payload path should validate thatorigin_len == 0before returning.🤖 Prompt for AI Agents