[v24.x] lib: backport _tls_common and _tls_wrap refactors by targos · Pull Request #61044 · nodejs/node

targos · 2025-12-13T14:55:46Z

This is the same as the original change, minus the process.emitWarning calls and unit tests that expect the deprecation warnings.

Refs: #57643

nodejs-github-bot · 2025-12-13T14:55:50Z

Review requested:

@nodejs/crypto
@nodejs/net
@nodejs/startup

targos · 2025-12-23T08:18:09Z

/cc @dario-piotrowicz

nodejs-github-bot · 2026-01-01T14:00:54Z

CI: https://ci.nodejs.org/job/node-test-pull-request/70646/

targos · 2026-01-23T14:38:20Z

To be transparent: I rebased, ignored the conflict in lib/_tls_wrap.js (keep full deletion of the code) and reapplied the security fixes by cherry-picking them from the v25.x branch.

nodejs-github-bot · 2026-02-03T18:56:25Z

CI: https://ci.nodejs.org/job/node-test-pull-request/71183/

codecov · 2026-02-03T19:06:48Z

Codecov Report

❌ Patch coverage is 95.23327% with 94 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.10%. Comparing base (4606233) to head (065c9b0).
⚠️ Report is 7 commits behind head on v24.x-staging.

Files with missing lines	Patch %	Lines
lib/internal/tls/wrap.js	95.00%	88 Missing and 2 partials ⚠️
lib/internal/tls/common.js	97.43%	4 Missing ⚠️

Additional details and impacted files

@@                Coverage Diff                @@
##           v24.x-staging   #61044      +/-   ##
=================================================
+ Coverage          90.07%   90.10%   +0.03%     
=================================================
  Files                665      667       +2     
  Lines             199008   199019      +11     
  Branches           38909    38911       +2     
=================================================
+ Hits              179247   179335      +88     
+ Misses             12133    12040      -93     
- Partials            7628     7644      +16

Files with missing lines	Coverage Δ
lib/_tls_common.js	`100.00% <100.00%> (+2.56%)`	⬆️
lib/_tls_wrap.js	`100.00% <100.00%> (+5.00%)`	⬆️
lib/internal/crypto/x509.js	`91.66% <100.00%> (ø)`
lib/tls.js	`93.10% <100.00%> (ø)`
src/node_builtins.cc	`79.56% <ø> (-0.25%)`	⬇️
lib/internal/tls/common.js	`97.43% <97.43%> (ø)`
lib/internal/tls/wrap.js	`95.00% <95.00%> (ø)`

... and 37 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-02-04T10:30:43Z

CI: https://ci.nodejs.org/job/node-test-pull-request/71193/

This is the same as the original change, minus the `process.emitWarning` calls and unit tests that expect the deprecation warnings, plus re-application of the fixes for CVE-2025-59465 and CVE-2026-21637. Original commit message: lib: deprecate _tls_common and _tls_wrap runtime deprecate the _tls_common and _tls_wrap modules, users should use nust node:tls insteal and internally internal/tls/commond and internal/tls/wrap should be used instead PR-URL: nodejs#57643 Backport-PR-URL: nodejs#61044 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

This prevents the server from crashing due to an unhandled rejection when a TLSSocket connection is abruptly destroyed during initialization and the user has not attached an error handler to the socket. e.g: ```js const server = http2.createSecureServer({ ... }) server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ``` PR-URL: nodejs-private/node-private#750 Backport-PR-URL: nodejs#61044 Fixes: nodejs#44751 Refs: https://hackerone.com/bugs?subject=nodejs&report_id=3262404 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> CVE-ID: CVE-2025-59465 Refs: nodejs#57643

Wrap pskCallback and ALPNCallback invocations in try-catch blocks to route exceptions through owner.destroy() instead of letting them become uncaught exceptions. This prevents remote attackers from crashing TLS servers or causing resource exhaustion. Fixes: https://hackerone.com/reports/3473882 PR-URL: nodejs-private/node-private#782 Backport-PR-URL: nodejs#61044 CVE-ID: CVE-2026-21637 Refs: nodejs#57643

This is the same as the original change, minus the `process.emitWarning` calls and unit tests that expect the deprecation warnings, plus re-application of the fixes for CVE-2025-59465 and CVE-2026-21637. Original commit message: lib: deprecate _tls_common and _tls_wrap runtime deprecate the _tls_common and _tls_wrap modules, users should use nust node:tls insteal and internally internal/tls/commond and internal/tls/wrap should be used instead PR-URL: nodejs#57643 Backport-PR-URL: nodejs#61044 Co-authored-by: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <targos@protonmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

This prevents the server from crashing due to an unhandled rejection when a TLSSocket connection is abruptly destroyed during initialization and the user has not attached an error handler to the socket. e.g: ```js const server = http2.createSecureServer({ ... }) server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ``` PR-URL: nodejs-private/node-private#750 Backport-PR-URL: nodejs#61044 Fixes: nodejs#44751 Refs: https://hackerone.com/bugs?subject=nodejs&report_id=3262404 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> CVE-ID: CVE-2025-59465 Refs: nodejs#57643

Wrap pskCallback and ALPNCallback invocations in try-catch blocks to route exceptions through owner.destroy() instead of letting them become uncaught exceptions. This prevents remote attackers from crashing TLS servers or causing resource exhaustion. Fixes: https://hackerone.com/reports/3473882 PR-URL: nodejs-private/node-private#782 Backport-PR-URL: nodejs#61044 CVE-ID: CVE-2026-21637 Refs: nodejs#57643

aduh95 · 2026-02-04T13:02:21Z

Landed in 736dce3...065c9b0

This is the same as the original change, minus the `process.emitWarning` calls and unit tests that expect the deprecation warnings, plus re-application of the fixes for CVE-2025-59465 and CVE-2026-21637. Original commit message: lib: deprecate _tls_common and _tls_wrap runtime deprecate the _tls_common and _tls_wrap modules, users should use nust node:tls insteal and internally internal/tls/commond and internal/tls/wrap should be used instead PR-URL: #57643 Backport-PR-URL: #61044 Co-authored-by: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <targos@protonmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com> Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

This prevents the server from crashing due to an unhandled rejection when a TLSSocket connection is abruptly destroyed during initialization and the user has not attached an error handler to the socket. e.g: ```js const server = http2.createSecureServer({ ... }) server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ``` PR-URL: nodejs-private/node-private#750 Backport-PR-URL: #61044 Fixes: #44751 Refs: https://hackerone.com/bugs?subject=nodejs&report_id=3262404 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> CVE-ID: CVE-2025-59465 Refs: #57643

Wrap pskCallback and ALPNCallback invocations in try-catch blocks to route exceptions through owner.destroy() instead of letting them become uncaught exceptions. This prevents remote attackers from crashing TLS servers or causing resource exhaustion. Fixes: https://hackerone.com/reports/3473882 PR-URL: nodejs-private/node-private#782 Backport-PR-URL: #61044 CVE-ID: CVE-2026-21637 Refs: #57643

targos mentioned this pull request Dec 13, 2025

lib: deprecate _tls_common and _tls_wrap #57643

Merged

nodejs-github-bot added lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch. labels Dec 13, 2025

avivkeller approved these changes Jan 1, 2026

View reviewed changes

targos added the request-ci Add this label to start a Jenkins CI on a PR. label Jan 1, 2026

github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jan 1, 2026

marco-ippolito force-pushed the v24.x-staging branch from d4dceb9 to 2358296 Compare January 13, 2026 13:27

targos force-pushed the backport-tls-v24 branch from b885b3a to 2ea4e1a Compare January 23, 2026 14:35

aduh95 force-pushed the v24.x-staging branch from 4606233 to 736dce3 Compare February 4, 2026 10:06

aduh95 force-pushed the backport-tls-v24 branch from 2ea4e1a to c6215d7 Compare February 4, 2026 11:21

dario-piotrowicz and others added 3 commits February 4, 2026 12:22

aduh95 force-pushed the backport-tls-v24 branch from c6215d7 to 065c9b0 Compare February 4, 2026 11:22

aduh95 merged commit 065c9b0 into nodejs:v24.x-staging Feb 4, 2026
19 of 20 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[v24.x] lib: backport _tls_common and _tls_wrap refactors#61044

[v24.x] lib: backport _tls_common and _tls_wrap refactors#61044
aduh95 merged 3 commits intonodejs:v24.x-stagingfrom
targos:backport-tls-v24

targos commented Dec 13, 2025

Uh oh!

nodejs-github-bot commented Dec 13, 2025

Uh oh!

targos commented Dec 23, 2025

Uh oh!

nodejs-github-bot commented Jan 1, 2026

Uh oh!

targos commented Jan 23, 2026

Uh oh!

nodejs-github-bot commented Feb 3, 2026

Uh oh!

codecov bot commented Feb 3, 2026 •

edited

Loading

Uh oh!

nodejs-github-bot commented Feb 4, 2026

Uh oh!

Uh oh!

aduh95 commented Feb 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Uh oh!

Conversation

targos commented Dec 13, 2025

Uh oh!

nodejs-github-bot commented Dec 13, 2025

Uh oh!

targos commented Dec 23, 2025

Uh oh!

nodejs-github-bot commented Jan 1, 2026

Uh oh!

targos commented Jan 23, 2026

Uh oh!

nodejs-github-bot commented Feb 3, 2026

Uh oh!

codecov bot commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

nodejs-github-bot commented Feb 4, 2026

Uh oh!

Uh oh!

aduh95 commented Feb 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

codecov bot commented Feb 3, 2026 •

edited

Loading