Commit d74b3a7
doc: clarify callback exceptions
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #63939
Fixes: nodejs/security-wg#1568
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>1 parent 688e792 commit d74b3a7
1 file changed
Lines changed: 15 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -374,6 +374,21 @@ the community they pose. | |||
| 374 | 374 | responsibility to properly handle errors by attaching appropriate | |
| 375 | 375 | `'error'` event listeners to EventEmitters that may emit errors. | |
| 376 | 376 | ||
| 377 | + #### Exceptions Thrown by Application Callbacks (CWE-248) | ||
| 378 | + | ||
| 379 | + * Node.js trusts the application code it is asked to run, including callbacks | ||
| 380 | + that are invoked by Node.js APIs. If an application callback throws an | ||
| 381 | + uncaught exception, any resulting crash is not considered a vulnerability in | ||
| 382 | + Node.js. | ||
| 383 | + * For example, [CVE-2026-21637](https://www.cve.org/CVERecord?id=CVE-2026-21637) | ||
| 384 | + was triaged as a Node.js vulnerability, but scenarios that require TLS | ||
| 385 | + callbacks such as `ALPNCallback`, `SNICallback`, or `pskCallback` to throw | ||
| 386 | + are outside the Node.js threat model. Future reports of similar issues, | ||
| 387 | + where the crash depends on application callbacks throwing uncaught | ||
| 388 | + exceptions, will not be treated as Node.js vulnerabilities. It is the | ||
| 389 | + application's responsibility to handle unexpected callback input and report | ||
| 390 | + errors without throwing uncaught exceptions. | ||
| 391 | + | ||
| 377 | 392 | #### Permission Model Boundaries (`--permission`) | |
| 378 | 393 | ||
| 379 | 394 | The Node.js [Permission Model](https://nodejs.org/api/permissions.html) | |
0 commit comments