Codestin Search App

legendecas · 2026-01-13T15:09:42Z

deps: V8: cherry-pick c5ff7c4d6cde

Original commit message:

[builtins] disallow ArrayBuffer transfer with a detach key

This allows embedder to disallow `ArrayBuffer.prototype.transfer()` on
an arraybuffer that is not detachable. This also fix the check on
`ArrayBufferCopyAndDetach` step 8 of `ArrayBuffer.prototype.transfer`.

Refs: https://github.com/nodejs/node/issues/61362
Refs: https://tc39.es/ecma262/#sec-arraybuffercopyanddetach
Change-Id: I3c6e156a8fad007fd100218d8b16aed5c4e1db68
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7454288
Commit-Queue: Chengzhong Wu <[email protected]>
Reviewed-by: Olivier Flückiger <[email protected]>
Cr-Commit-Position: refs/heads/main@{#104697}

Refs: v8/v8@c5ff7c4

buffer: disallow ArrayBuffer transfer on pooled buffer

This is an alternative solution that disallows transfer operation on buffer pool.

Depends on https://chromium-review.googlesource.com/c/v8/v8/+/7454288.

Fixes: #61362

nodejs-github-bot · 2026-01-13T15:09:48Z

Review requested:

@nodejs/security-wg
@nodejs/v8-update

Renegade334 · 2026-01-13T17:05:23Z

This requires V8 changes to properly work.

I don't believe so – calling SetDetachKey() on the array buffer object should effectively mark the object as untransferable, without setting the flag on the object handle directly?

legendecas · 2026-01-13T17:59:30Z

https://chromium-review.googlesource.com/c/v8/v8/+/7454288 would be required to have SetDetachKey() properly disables arrayBuffer.transfer().

lib/internal/buffer.js

addaleax · 2026-01-15T16:39:12Z

lib/internal/buffer.js


 // This would better be placed in internal/worker/io.js, but that doesn't work
 // because Buffer needs this and that would introduce a cyclic dependency.
 function markAsUntransferable(obj) {


This is a public method on the worker_threads module, I'd suggest adding a documentation update there (and I'd say this doesn't count as a breaking change, since it is very much in line with the intent of this method)

lib/internal/buffer.js

codecov · 2026-01-15T19:40:20Z

Codecov Report

❌ Patch coverage is 84.37500% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.84%. Comparing base (41c6256) to head (513d284).
⚠️ Report is 55 commits behind head on main.

Files with missing lines	Patch %	Lines
lib/buffer.js	78.57%	3 Missing ⚠️
src/node_buffer.cc	77.77%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #61372      +/-   ##
==========================================
- Coverage   89.85%   89.84%   -0.01%     
==========================================
  Files         671      671              
  Lines      203309   203341      +32     
  Branches    39085    39102      +17     
==========================================
+ Hits       182677   182690      +13     
- Misses      12972    12994      +22     
+ Partials     7660     7657       -3

Files with missing lines	Coverage Δ
lib/internal/buffer.js	`98.74% <100.00%> (+0.01%)`	⬆️
src/node_buffer.cc	`68.70% <77.77%> (+0.08%)`	⬆️
lib/buffer.js	`99.78% <78.57%> (-0.22%)`	⬇️

... and 38 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

legendecas · 2026-01-16T20:30:31Z

It looks like quic tests are failing because it tries to detach certs buffer, which is read with fs.readFileSync that internally uses pooled buffer with Buffer.allocUnsafe.

Submitting a separate PR to address it: #61403

The certs could be allocated in a pooled buffer, like `Buffer.from`, and `Buffer.allocUnsafe` (used by `fs.readFileSync`, etc). PR-URL: #61403 Refs: #61372 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Anna Henningsen <[email protected]>

Original commit message: [builtins] disallow ArrayBuffer transfer with a detach key This allows embedder to disallow `ArrayBuffer.prototype.transfer()` on an arraybuffer that is not detachable. This also fix the check on `ArrayBufferCopyAndDetach` step 8 of `ArrayBuffer.prototype.transfer`. Refs: nodejs#61362 Refs: https://tc39.es/ecma262/#sec-arraybuffercopyanddetach Change-Id: I3c6e156a8fad007fd100218d8b16aed5c4e1db68 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7454288 Commit-Queue: Chengzhong Wu <[email protected]> Reviewed-by: Olivier Flückiger <[email protected]> Cr-Commit-Position: refs/heads/main@{#104697} Refs: v8/v8@c5ff7c4

nodejs-github-bot · 2026-01-22T19:39:46Z

CI: https://ci.nodejs.org/job/node-test-pull-request/70973/

The certs could be allocated in a pooled buffer, like `Buffer.from`, and `Buffer.allocUnsafe` (used by `fs.readFileSync`, etc). PR-URL: #61403 Refs: #61372 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Anna Henningsen <[email protected]>

The certs could be allocated in a pooled buffer, like `Buffer.from`, and `Buffer.allocUnsafe` (used by `fs.readFileSync`, etc). PR-URL: nodejs#61403 Refs: nodejs#61372 Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Anna Henningsen <[email protected]>

nodejs-github-bot · 2026-01-28T16:32:57Z

Landed in a9dd48f...6cc2ed5

Original commit message: [builtins] disallow ArrayBuffer transfer with a detach key This allows embedder to disallow `ArrayBuffer.prototype.transfer()` on an arraybuffer that is not detachable. This also fix the check on `ArrayBufferCopyAndDetach` step 8 of `ArrayBuffer.prototype.transfer`. Refs: #61362 Refs: https://tc39.es/ecma262/#sec-arraybuffercopyanddetach Change-Id: I3c6e156a8fad007fd100218d8b16aed5c4e1db68 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7454288 Commit-Queue: Chengzhong Wu <[email protected]> Reviewed-by: Olivier Flückiger <[email protected]> Cr-Commit-Position: refs/heads/main@{#104697} Refs: v8/v8@c5ff7c4 PR-URL: #61372 Fixes: #61362 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: René <[email protected]>

PR-URL: #61372 Fixes: #61362 Refs: v8/v8@c5ff7c4 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: René <[email protected]>

Original commit message: [builtins] disallow ArrayBuffer transfer with a detach key This allows embedder to disallow `ArrayBuffer.prototype.transfer()` on an arraybuffer that is not detachable. This also fix the check on `ArrayBufferCopyAndDetach` step 8 of `ArrayBuffer.prototype.transfer`. Refs: #61362 Refs: https://tc39.es/ecma262/#sec-arraybuffercopyanddetach Change-Id: I3c6e156a8fad007fd100218d8b16aed5c4e1db68 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7454288 Commit-Queue: Chengzhong Wu <[email protected]> Reviewed-by: Olivier Flückiger <[email protected]> Cr-Commit-Position: refs/heads/main@{#104697} Refs: v8/v8@c5ff7c4 PR-URL: #61372 Fixes: #61362 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: René <[email protected]>

PR-URL: #61372 Fixes: #61362 Refs: v8/v8@c5ff7c4 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: René <[email protected]>

Original commit message: [builtins] disallow ArrayBuffer transfer with a detach key This allows embedder to disallow `ArrayBuffer.prototype.transfer()` on an arraybuffer that is not detachable. This also fix the check on `ArrayBufferCopyAndDetach` step 8 of `ArrayBuffer.prototype.transfer`. Refs: nodejs#61362 Refs: https://tc39.es/ecma262/#sec-arraybuffercopyanddetach Change-Id: I3c6e156a8fad007fd100218d8b16aed5c4e1db68 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7454288 Commit-Queue: Chengzhong Wu <[email protected]> Reviewed-by: Olivier Flückiger <[email protected]> Cr-Commit-Position: refs/heads/main@{#104697} Refs: v8/v8@c5ff7c4 PR-URL: nodejs#61372 Fixes: nodejs#61362 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: René <[email protected]>

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Jan 13, 2026

ChALkeR mentioned this pull request Jan 13, 2026

allocUnsafe is useless since 24 #60423

Open

ChALkeR mentioned this pull request Jan 13, 2026

Can not construct Buffer after different Buffer was previously transfererd #61362

Closed

Renegade334 mentioned this pull request Jan 14, 2026

buffer: recreate pooled ArrayBuffer after transfer #61364

Closed

legendecas force-pushed the buffer-transfer branch from cd3d626 to 749c2fc Compare January 15, 2026 14:24

legendecas marked this pull request as ready for review January 15, 2026 14:24

addaleax approved these changes Jan 15, 2026

View reviewed changes

legendecas force-pushed the buffer-transfer branch from 749c2fc to 70fcbd5 Compare January 15, 2026 16:59

Renegade334 reviewed Jan 15, 2026

View reviewed changes

lib/internal/buffer.js Outdated Show resolved Hide resolved

legendecas mentioned this pull request Jan 16, 2026

quic: copy options buffer instead of detaching #61403

Merged

legendecas force-pushed the buffer-transfer branch 2 times, most recently from fa99c0d to a7d8f6a Compare January 22, 2026 16:18

buffer: disallow ArrayBuffer transfer on pooled buffer

513d284

legendecas force-pushed the buffer-transfer branch from a7d8f6a to 513d284 Compare January 22, 2026 16:18

Renegade334 approved these changes Jan 28, 2026

View reviewed changes

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Jan 28, 2026

nodejs-github-bot pushed a commit that referenced this pull request Jan 28, 2026

buffer: disallow ArrayBuffer transfer on pooled buffer

6cc2ed5

PR-URL: #61372 Fixes: #61362 Refs: v8/v8@c5ff7c4 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: René <[email protected]>

nodejs-github-bot closed this Jan 28, 2026

legendecas deleted the buffer-transfer branch January 28, 2026 16:39

Renegade334 added the lts-watch-v24.x PRs that may need to be released in v24.x label Jan 28, 2026

aduh95 pushed a commit that referenced this pull request Jan 28, 2026

buffer: disallow ArrayBuffer transfer on pooled buffer

8759db9

PR-URL: #61372 Fixes: #61362 Refs: v8/v8@c5ff7c4 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: René <[email protected]>

github-actions bot mentioned this pull request Feb 2, 2026

2026-02-03, Version 25.6.0 (Current) #61635

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

buffer: disallow ArrayBuffer transfer on pooled buffer#61372

buffer: disallow ArrayBuffer transfer on pooled buffer#61372
legendecas wants to merge 2 commits intonodejs:mainfrom
legendecas:buffer-transfer

legendecas commented Jan 13, 2026 •

edited

Loading

Uh oh!

nodejs-github-bot commented Jan 13, 2026

Uh oh!

Renegade334 commented Jan 13, 2026 •

edited

Loading

Uh oh!

legendecas commented Jan 13, 2026

Uh oh!

Uh oh!

addaleax Jan 15, 2026

Uh oh!

Uh oh!

codecov bot commented Jan 15, 2026 •

edited

Loading

Uh oh!

legendecas commented Jan 16, 2026

Uh oh!

nodejs-github-bot commented Jan 22, 2026

Uh oh!

nodejs-github-bot commented Jan 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

legendecas commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

deps: V8: cherry-pick c5ff7c4d6cde

buffer: disallow ArrayBuffer transfer on pooled buffer

Uh oh!

nodejs-github-bot commented Jan 13, 2026

Uh oh!

Renegade334 commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

legendecas commented Jan 13, 2026

Uh oh!

Uh oh!

addaleax Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov bot commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

legendecas commented Jan 16, 2026

Uh oh!

nodejs-github-bot commented Jan 22, 2026

Uh oh!

nodejs-github-bot commented Jan 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

legendecas commented Jan 13, 2026 •

edited

Loading

Renegade334 commented Jan 13, 2026 •

edited

Loading

codecov bot commented Jan 15, 2026 •

edited

Loading