Skip to content

[pull] main from nodejs:main#852

Merged
pull[bot] merged 2 commits intoadamlaska:mainfrom
nodejs:main
Mar 27, 2026
Merged

[pull] main from nodejs:main#852
pull[bot] merged 2 commits intoadamlaska:mainfrom
nodejs:main

Conversation

@pull
Copy link
Copy Markdown

@pull pull bot commented Mar 27, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

guybedford and others added 2 commits March 26, 2026 14:12
PR-URL: #62415
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
The Reset() method did not check the write_in_progress_ flag before
resetting the compression stream. This allowed reset() to free the
compression library's internal state while a worker thread was still
using it during an async write, causing a use-after-free.

Add a write_in_progress_ guard to Reset() that throws an error if a
write is in progress, matching the existing pattern used by Close()
and Write().

PR-URL: TODO
Refs: https://hackerone.com/reports/3609132
PR-URL: #62325
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
@pull pull bot locked and limited conversation to collaborators Mar 27, 2026
@pull pull bot added the ⤵️ pull label Mar 27, 2026
@pull pull bot merged commit 53bcd11 into adamlaska:main Mar 27, 2026
0 of 3 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants