buffer: disallow ArrayBuffer transfer on pooled buffer by legendecas · Pull Request #61372 · nodejs/node

legendecas · 2026-01-13T15:09:42Z

deps: V8: cherry-pick c5ff7c4d6cde

Original commit message:

[builtins] disallow ArrayBuffer transfer with a detach key

This allows embedder to disallow `ArrayBuffer.prototype.transfer()` on
an arraybuffer that is not detachable. This also fix the check on
`ArrayBufferCopyAndDetach` step 8 of `ArrayBuffer.prototype.transfer`.

Refs: https://github.com/nodejs/node/issues/61362
Refs: https://tc39.es/ecma262/#sec-arraybuffercopyanddetach
Change-Id: I3c6e156a8fad007fd100218d8b16aed5c4e1db68
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7454288
Commit-Queue: Chengzhong Wu <cwu631@bloomberg.net>
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#104697}

Refs: v8/v8@c5ff7c4

buffer: disallow ArrayBuffer transfer on pooled buffer

This is an alternative solution that disallows transfer operation on buffer pool.

Depends on https://chromium-review.googlesource.com/c/v8/v8/+/7454288.

Fixes: #61362

nodejs-github-bot · 2026-01-13T15:09:48Z

Review requested:

@nodejs/security-wg
@nodejs/v8-update

Renegade334 · 2026-01-13T17:05:23Z

This requires V8 changes to properly work.

I don't believe so – calling SetDetachKey() on the array buffer object should effectively mark the object as untransferable, without setting the flag on the object handle directly?

legendecas · 2026-01-13T17:59:30Z

https://chromium-review.googlesource.com/c/v8/v8/+/7454288 would be required to have SetDetachKey() properly disables arrayBuffer.transfer().

addaleax · 2026-01-15T16:39:12Z

This is a public method on the worker_threads module, I'd suggest adding a documentation update there (and I'd say this doesn't count as a breaking change, since it is very much in line with the intent of this method)

codecov · 2026-01-15T19:40:20Z

Codecov Report

❌ Patch coverage is 84.37500% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.84%. Comparing base (41c6256) to head (513d284).
⚠️ Report is 55 commits behind head on main.

Files with missing lines	Patch %	Lines
lib/buffer.js	78.57%	3 Missing ⚠️
src/node_buffer.cc	77.77%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #61372      +/-   ##
==========================================
- Coverage   89.85%   89.84%   -0.01%     
==========================================
  Files         671      671              
  Lines      203309   203341      +32     
  Branches    39085    39102      +17     
==========================================
+ Hits       182677   182690      +13     
- Misses      12972    12994      +22     
+ Partials     7660     7657       -3

Files with missing lines	Coverage Δ
lib/internal/buffer.js	`98.74% <100.00%> (+0.01%)`	⬆️
src/node_buffer.cc	`68.70% <77.77%> (+0.08%)`	⬆️
lib/buffer.js	`99.78% <78.57%> (-0.22%)`	⬇️

... and 38 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

legendecas · 2026-01-16T20:30:31Z

It looks like quic tests are failing because it tries to detach certs buffer, which is read with fs.readFileSync that internally uses pooled buffer with Buffer.allocUnsafe.

Submitting a separate PR to address it: #61403

The certs could be allocated in a pooled buffer, like `Buffer.from`, and `Buffer.allocUnsafe` (used by `fs.readFileSync`, etc). PR-URL: #61403 Refs: #61372 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>

Original commit message: [builtins] disallow ArrayBuffer transfer with a detach key This allows embedder to disallow `ArrayBuffer.prototype.transfer()` on an arraybuffer that is not detachable. This also fix the check on `ArrayBufferCopyAndDetach` step 8 of `ArrayBuffer.prototype.transfer`. Refs: nodejs#61362 Refs: https://tc39.es/ecma262/#sec-arraybuffercopyanddetach Change-Id: I3c6e156a8fad007fd100218d8b16aed5c4e1db68 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7454288 Commit-Queue: Chengzhong Wu <cwu631@bloomberg.net> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#104697} Refs: v8/v8@c5ff7c4

nodejs-github-bot · 2026-01-22T19:39:46Z

CI: https://ci.nodejs.org/job/node-test-pull-request/70973/

The certs could be allocated in a pooled buffer, like `Buffer.from`, and `Buffer.allocUnsafe` (used by `fs.readFileSync`, etc). PR-URL: #61403 Refs: #61372 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>

nodejs-github-bot · 2026-01-28T16:32:57Z

Landed in a9dd48f...6cc2ed5

Original commit message: [builtins] disallow ArrayBuffer transfer with a detach key This allows embedder to disallow `ArrayBuffer.prototype.transfer()` on an arraybuffer that is not detachable. This also fix the check on `ArrayBufferCopyAndDetach` step 8 of `ArrayBuffer.prototype.transfer`. Refs: #61362 Refs: https://tc39.es/ecma262/#sec-arraybuffercopyanddetach Change-Id: I3c6e156a8fad007fd100218d8b16aed5c4e1db68 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7454288 Commit-Queue: Chengzhong Wu <cwu631@bloomberg.net> Reviewed-by: Olivier Flückiger <olivf@chromium.org> Cr-Commit-Position: refs/heads/main@{#104697} Refs: v8/v8@c5ff7c4 PR-URL: #61372 Fixes: #61362 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>