deps: call OPENSSL_free after ANS1_STRING_to_UTF8 by RafaelGSS · Pull Request #60609 · nodejs/node · GitHub

PTAL @mcollina @jasnell @smithc

Refs: #58380

I took the liberty to add you as Co-Authored-By - I hope you don't mind. Can you check if I'm using your best email?

Review requested:

@nodejs/crypto
@nodejs/security-wg

Fast-track has been requested by @RafaelGSS. Please 👍 to approve.

lgtm

Co-Authored-By: Chris Smith <chrismith@vista.com> Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

CI: https://ci.nodejs.org/job/node-test-pull-request/70086/

CI: https://ci.nodejs.org/job/node-test-pull-request/70087/

Landed in 5e1ab9f

Co-Authored-By: Chris Smith <chrismith@vista.com> Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #60609 Refs: #58380 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [node](https://nodejs.org) ([source](https://github.com/nodejs/node)) | minor | `25.1.0` -> `25.2.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v25.2.0`](https://github.com/nodejs/node/releases/tag/v25.2.0): 2025-11-11, Version 25.2.0 (Current), @aduh95 [Compare Source](nodejs/node@v25.1.0...v25.2.0) ##### Notable Changes - \[[`a37c01e6a1`](nodejs/node@a37c01e6a1)] - **(SEMVER-MINOR)** **lib**: add options to util.deprecate (Rafael Gonzaga) [#59982](nodejs/node#59982) - \[[`4fbb1ab101`](nodejs/node@4fbb1ab101)] - **lib**: throw from localStorage getter on missing storage path (René) [#60351](nodejs/node#60351) - \[[`727560a96d`](nodejs/node@727560a96d)] - **(SEMVER-MINOR)** **module**: mark type stripping as stable (Marco Ippolito) [#60600](nodejs/node#60600) - \[[`506b79e888`](nodejs/node@506b79e888)] - **(SEMVER-MINOR)** **net**: increase network family autoselection timeout to 500ms (Rod Vagg) [#60334](nodejs/node#60334) - \[[`166c72ec02`](nodejs/node@166c72ec02)] - **(SEMVER-MINOR)** **node-api**: add napi\_create\_object\_with\_properties (Miguel Marcondes Filho) [#59953](nodejs/node#59953) - \[[`399b340022`](nodejs/node@399b340022)] - **(SEMVER-MINOR)** **v8**: adding total\_allocated\_bytes to HeapStatistics (Caio Lima) [#60573](nodejs/node#60573) ##### Commits - \[[`d5158a0a2d`](nodejs/node@d5158a0a2d)] - **benchmark**: focus on import.meta intialization in import-meta benchmark (Joyee Cheung) [#60603](nodejs/node#60603) - \[[`26a5305fa9`](nodejs/node@26a5305fa9)] - **benchmark**: add per-suite setup option (Joyee Cheung) [#60574](nodejs/node#60574) - \[[`4810e4b82d`](nodejs/node@4810e4b82d)] - **buffer**: speed up concat via TypedArray#set (Gürgün Dayıoğlu) [#60399](nodejs/node#60399) - \[[`94a94a6b3a`](nodejs/node@94a94a6b3a)] - **console**: optimize single-string logging (Gürgün Dayıoğlu) [#60422](nodejs/node#60422) - \[[`ad376c31db`](nodejs/node@ad376c31db)] - **crypto**: fix argument validation in crypto.timingSafeEqual fast path (Joyee Cheung) [#60538](nodejs/node#60538) - \[[`dc38a45a55`](nodejs/node@dc38a45a55)] - **debugger**: fix event listener leak in the run command (Joyee Cheung) [#60464](nodejs/node#60464) - \[[`a61e5d8e05`](nodejs/node@a61e5d8e05)] - **deps**: call OPENSSL\_free after ANS1\_STRING\_to\_UTF8 (Rafael Gonzaga) [#60609](nodejs/node#60609) - \[[`51e5030afa`](nodejs/node@51e5030afa)] - **deps**: nghttp2: revert [`7784fa9`](nodejs/node@7784fa979d0b) (Antoine du Hamel) [#59790](nodejs/node#59790) - \[[`eef838f499`](nodejs/node@eef838f499)] - **deps**: update nghttp2 to 1.67.1 (nodejs-github-bot) [#59790](nodejs/node#59790) - \[[`13120a43d4`](nodejs/node@13120a43d4)] - **deps**: update simdjson to 4.1.0 (Node.js GitHub Bot) [#60542](nodejs/node#60542) - \[[`6e1b23dab8`](nodejs/node@6e1b23dab8)] - **deps**: update corepack to 0.34.2 (Node.js GitHub Bot) [#60550](nodejs/node#60550) - \[[`a02e05c486`](nodejs/node@a02e05c486)] - **deps**: update amaro to 1.1.5 (Node.js GitHub Bot) [#60541](nodejs/node#60541) - \[[`b9ba3a7947`](nodejs/node@b9ba3a7947)] - **deps**: V8: backport [`fe81545`](nodejs/node@fe81545e6d14) (Caio Lima) [#60429](nodejs/node#60429) - \[[`07bcd28494`](nodejs/node@07bcd28494)] - **deps**: V8: cherry-pick [`7ef6a00`](nodejs/node@7ef6a001762) (Xiao-Tao) [#60259](nodejs/node#60259) - \[[`3e11658243`](nodejs/node@3e11658243)] - **doc**: update Collaborators list to reflect hybrist handle change (Antoine du Hamel) [#60650](nodejs/node#60650) - \[[`b8e40e4d38`](nodejs/node@b8e40e4d38)] - **doc**: fix link in `--env-file=file` section (N. Bighetti) [#60563](nodejs/node#60563) - \[[`9558c1c0df`](nodejs/node@9558c1c0df)] - **doc**: fix linter issues (Antoine du Hamel) [#60636](nodejs/node#60636) - \[[`cdf70de563`](nodejs/node@cdf70de563)] - **doc**: add missing history entry for `sqlite.md` (Antoine du Hamel) [#60607](nodejs/node#60607) - \[[`e3c5dcf1ea`](nodejs/node@e3c5dcf1ea)] - **doc**: correct values/references for buffer.kMaxLength (René) [#60305](nodejs/node#60305) - \[[`a25d76c924`](nodejs/node@a25d76c924)] - **doc**: recommend events.once to manage 'close' event (Dan Fabulich) [#60017](nodejs/node#60017) - \[[`795f32bf91`](nodejs/node@795f32bf91)] - **doc**: highlight module loading difference between import and require (Ajay A) [#59815](nodejs/node#59815) - \[[`212775410b`](nodejs/node@212775410b)] - **doc**: add CJS code snippets in `sqlite.md` (Allon Murienik) [#60395](nodejs/node#60395) - \[[`263c06096d`](nodejs/node@263c06096d)] - **doc**: fix typo in `process.unref` documentation (우혁) [#59698](nodejs/node#59698) - \[[`356bdae408`](nodejs/node@356bdae408)] - **doc**: add some entries to `glossary.md` (Mohataseem Khan) [#59277](nodejs/node#59277) - \[[`9632c398de`](nodejs/node@9632c398de)] - **doc**: improve agent.createConnection docs for http and https agents (JaeHo Jang) [#58205](nodejs/node#58205) - \[[`f72880dbe3`](nodejs/node@f72880dbe3)] - **doc**: fix pseudo code in modules.md (chirsz) [#57677](nodejs/node#57677) - \[[`a9c70cefe8`](nodejs/node@a9c70cefe8)] - **doc**: add missing variable in code snippet (Koushil Mankali) [#55478](nodejs/node#55478) - \[[`2892d151d4`](nodejs/node@2892d151d4)] - **doc**: add missing word in `single-executable-applications.md` (Konstantin Tsabolov) [#53864](nodejs/node#53864) - \[[`9c99ab6571`](nodejs/node@9c99ab6571)] - **doc**: fix typo in http.md (Michael Solomon) [#59354](nodejs/node#59354) - \[[`3446cf375f`](nodejs/node@3446cf375f)] - **doc**: update devcontainer.json and add documentation (Joyee Cheung) [#60472](nodejs/node#60472) - \[[`519c537875`](nodejs/node@519c537875)] - **doc**: add haramj as triager (Haram Jeong) [#60348](nodejs/node#60348) - \[[`62889d7e99`](nodejs/node@62889d7e99)] - **doc**: clarify require(esm) description (dynst) [#60520](nodejs/node#60520) - \[[`0b9ef68705`](nodejs/node@0b9ef68705)] - **doc**: instantiate resolver object (Donghoon Nam) [#60476](nodejs/node#60476) - \[[`cd5c1ad29f`](nodejs/node@cd5c1ad29f)] - **doc**: correct module loading descriptions (Joyee Cheung) [#60346](nodejs/node#60346) - \[[`74719dad7a`](nodejs/node@74719dad7a)] - **doc**: clarify Linux runtime requirements for >=25 (Joyee Cheung) [#60484](nodejs/node#60484) - \[[`ca39540785`](nodejs/node@ca39540785)] - **doc**: clarify --use-system-ca support status (Joyee Cheung) [#60340](nodejs/node#60340) - \[[`dbf204c714`](nodejs/node@dbf204c714)] - **doc,crypto**: link keygen to supported types (Filip Skokan) [#60585](nodejs/node#60585) - \[[`3bcf86d56d`](nodejs/node@3bcf86d56d)] - **esm**: use sync loading/resolving on non-loader-hook thread (Joyee Cheung) [#60380](nodejs/node#60380) - \[[`69b3d2c845`](nodejs/node@69b3d2c845)] - **http**: replace startsWith with strict equality (btea) [#59394](nodejs/node#59394) - \[[`a38e2f5975`](nodejs/node@a38e2f5975)] - **http2**: add diagnostics channels for client stream request body (Darshan Sen) [#60480](nodejs/node#60480) - \[[`c047e73a00`](nodejs/node@c047e73a00)] - **inspector**: inspect HTTP response body (Chengzhong Wu) [#60572](nodejs/node#60572) - \[[`d2087bae92`](nodejs/node@d2087bae92)] - **inspector**: support inspecting HTTP/2 request and response bodies (Darshan Sen) [#60483](nodejs/node#60483) - \[[`003121c475`](nodejs/node@003121c475)] - **inspector**: fix crash when receiving non json message (Shima Ryuhei) [#60388](nodejs/node#60388) - \[[`a37c01e6a1`](nodejs/node@a37c01e6a1)] - **(SEMVER-MINOR)** **lib**: add options to util.deprecate (Rafael Gonzaga) [#59982](nodejs/node#59982) - \[[`219d2e978d`](nodejs/node@219d2e978d)] - **lib**: replace global SharedArrayBuffer constructor with bound method (Renegade334) [#60497](nodejs/node#60497) - \[[`4fbb1ab101`](nodejs/node@4fbb1ab101)] - **lib**: throw from localStorage getter on missing storage path (René) [#60351](nodejs/node#60351) - \[[`ca8934f44d`](nodejs/node@ca8934f44d)] - **meta**: bump cachix/install-nix-action from 31.6.1 to 31.8.2 (dependabot\[bot]) [#60534](nodejs/node#60534) - \[[`166490230a`](nodejs/node@166490230a)] - **meta**: bump github/codeql-action from 3.30.5 to 4.31.2 (dependabot\[bot]) [#60533](nodejs/node#60533) - \[[`b722236a12`](nodejs/node@b722236a12)] - **meta**: bump actions/download-artifact from 5.0.0 to 6.0.0 (dependabot\[bot]) [#60532](nodejs/node#60532) - \[[`3314b0bc60`](nodejs/node@3314b0bc60)] - **meta**: bump actions/upload-artifact from 4.6.2 to 5.0.0 (dependabot\[bot]) [#60531](nodejs/node#60531) - \[[`d1d9891feb`](nodejs/node@d1d9891feb)] - **meta**: bump actions/github-script from 7.0.1 to 8.0.0 (dependabot\[bot]) [#60530](nodejs/node#60530) - \[[`995596a34f`](nodejs/node@995596a34f)] - **meta**: bump actions/setup-node from 5.0.0 to 6.0.0 (dependabot\[bot]) [#60529](nodejs/node#60529) - \[[`b60157a0fe`](nodejs/node@b60157a0fe)] - **meta**: bump actions/stale from 10.0.0 to 10.1.0 (dependabot\[bot]) [#60528](nodejs/node#60528) - \[[`07fa6c9081`](nodejs/node@07fa6c9081)] - **meta**: call `create-release-post.yml` post release (Aviv Keller) [#60366](nodejs/node#60366) - \[[`727560a96d`](nodejs/node@727560a96d)] - **(SEMVER-MINOR)** **module**: mark type stripping as stable (Marco Ippolito) [#60600](nodejs/node#60600) - \[[`506b79e888`](nodejs/node@506b79e888)] - **(SEMVER-MINOR)** **net**: increase network family autoselection timeout to 500ms (Rod Vagg) [#60334](nodejs/node#60334) - \[[`166c72ec02`](nodejs/node@166c72ec02)] - **(SEMVER-MINOR)** **node-api**: add napi\_create\_object\_with\_properties (Miguel Marcondes Filho) [#59953](nodejs/node#59953) - \[[`6ab83cf979`](nodejs/node@6ab83cf979)] - **node-api**: use local files for instanceof test (Vladimir Morozov) [#60190](nodejs/node#60190) - \[[`3671851879`](nodejs/node@3671851879)] - **perf\_hooks**: move non-standard performance properties to perf\_hooks (Chengzhong Wu) [#60370](nodejs/node#60370) - \[[`6ddee4a7ed`](nodejs/node@6ddee4a7ed)] - **repl**: fix pasting after moving the cursor to the left (Ruben Bridgewater) [#60470](nodejs/node#60470) - \[[`edc3033905`](nodejs/node@edc3033905)] - **sqlite,doc**: fix StatementSync section (Edy Silva) [#60474](nodejs/node#60474) - \[[`e9b68e60d4`](nodejs/node@e9b68e60d4)] - **src**: move import.meta initializer to native land (Joyee Cheung) [#60603](nodejs/node#60603) - \[[`0ebf839a4f`](nodejs/node@0ebf839a4f)] - **src**: use CP\_UTF8 for wide file names on win32 (Fedor Indutny) [#60575](nodejs/node#60575) - \[[`a31ad37714`](nodejs/node@a31ad37714)] - **src**: show original file name in FileHandle GC close errors (Anna Henningsen) [#60593](nodejs/node#60593) - \[[`a6c221324b`](nodejs/node@a6c221324b)] - **src**: avoid C strings in more C++ exception throws (Anna Henningsen) [#60592](nodejs/node#60592) - \[[`fdff838ce3`](nodejs/node@fdff838ce3)] - **src**: add internal binding for constructing SharedArrayBuffers (Renegade334) [#60497](nodejs/node#60497) - \[[`4385b0b65f`](nodejs/node@4385b0b65f)] - **src**: move `napi_addon_register_func` to `node_api_types.h` (Anna Henningsen) [#60512](nodejs/node#60512) - \[[`de78da7887`](nodejs/node@de78da7887)] - **src**: move Node-API version detection to where it is used (Anna Henningsen) [#60512](nodejs/node#60512) - \[[`b606d46c3f`](nodejs/node@b606d46c3f)] - **src**: remove unconditional NAPI\_EXPERIMENTAL in node.h (Chengzhong Wu) [#60345](nodejs/node#60345) - \[[`5941341889`](nodejs/node@5941341889)] - **src**: clean up generic counter implementation (Anna Henningsen) [#60447](nodejs/node#60447) - \[[`7015f30e62`](nodejs/node@7015f30e62)] - **src**: add enum handle for ToStringHelper + formatting (Burkov Egor) [#56829](nodejs/node#56829) - \[[`39dfcbad6e`](nodejs/node@39dfcbad6e)] - **stream**: don't try to read more if reading (Robert Nagy) [#60454](nodejs/node#60454) - \[[`ee333c9177`](nodejs/node@ee333c9177)] - **test**: deflake test-perf-hooks-timerify-histogram-sync (Joyee Cheung) [#60639](nodejs/node#60639) - \[[`f0d81c91e7`](nodejs/node@f0d81c91e7)] - **test**: apply a delay to `watch-mode-kill-signal` tests (Joyee Cheung) [#60610](nodejs/node#60610) - \[[`68791e2ccc`](nodejs/node@68791e2ccc)] - **test**: async iife in repl (Tony Gorez) [#44878](nodejs/node#44878) - \[[`c4eb9c3383`](nodejs/node@c4eb9c3383)] - **test**: parallelize sea tests when there's enough disk space (Joyee Cheung) [#60604](nodejs/node#60604) - \[[`be8c4172d9`](nodejs/node@be8c4172d9)] - **test**: only show overridden env in child process failures (Joyee Cheung) [#60556](nodejs/node#60556) - \[[`8cae858f88`](nodejs/node@8cae858f88)] - **test**: ensure assertions are reached on more tests (Antoine du Hamel) [#60498](nodejs/node#60498) - \[[`759d69331e`](nodejs/node@759d69331e)] - **test**: ensure assertions are reachable in `test/es-module` (Antoine du Hamel) [#60501](nodejs/node#60501) - \[[`6aaf18c333`](nodejs/node@6aaf18c333)] - **test**: ensure assertions are reached on more tests (Antoine du Hamel) [#60485](nodejs/node#60485) - \[[`bc41acf087`](nodejs/node@bc41acf087)] - **test**: ensure assertions are reached on more tests (Antoine du Hamel) [#60500](nodejs/node#60500) - \[[`22fd621daf`](nodejs/node@22fd621daf)] - **test**: split test-perf-hooks-timerify (Joyee Cheung) [#60568](nodejs/node#60568) - \[[`5efe4f722e`](nodejs/node@5efe4f722e)] - **test**: add more logs to test-esm-loader-hooks-inspect-wait (Joyee Cheung) [#60466](nodejs/node#60466) - \[[`2a57268f34`](nodejs/node@2a57268f34)] - **test**: mark stringbytes-external-exceed-max tests as flaky on AIX (Joyee Cheung) [#60565](nodejs/node#60565) - \[[`2c199f7f61`](nodejs/node@2c199f7f61)] - **test**: split test-esm-wasm.js (Joyee Cheung) [#60491](nodejs/node#60491) - \[[`bc8f7db5bb`](nodejs/node@bc8f7db5bb)] - **test**: correct conditional secure heap flags test (Shelley Vohr) [#60385](nodejs/node#60385) - \[[`3bf42a5dd3`](nodejs/node@3bf42a5dd3)] - **test**: spin longer on flaky platforms for test-worker-prof (Joyee Cheung) [#60492](nodejs/node#60492) - \[[`eca6227e7e`](nodejs/node@eca6227e7e)] - **test**: ensure assertions are reachable in `test/internet` (Antoine du Hamel) [#60513](nodejs/node#60513) - \[[`313983453b`](nodejs/node@313983453b)] - **test**: fix flaky test-watch-mode-kill-signal-\* (Joyee Cheung) [#60443](nodejs/node#60443) - \[[`ccc26377b5`](nodejs/node@ccc26377b5)] - **test**: capture stack trace in debugger timeout errors (Joyee Cheung) [#60457](nodejs/node#60457) - \[[`12e9213a24`](nodejs/node@12e9213a24)] - **test**: ensure assertions are reachable in `test/sequential` (Antoine du Hamel) [#60412](nodejs/node#60412) - \[[`781a2661de`](nodejs/node@781a2661de)] - **test**: ensure assertions are reachable in more folders (Antoine du Hamel) [#60411](nodejs/node#60411) - \[[`1e979e6eb7`](nodejs/node@1e979e6eb7)] - **test**: split test-runner-watch-mode (Joyee Cheung) [#60391](nodejs/node#60391) - \[[`8c31cbb99b`](nodejs/node@8c31cbb99b)] - **test**: move test-runner-watch-mode helper into common (Joyee Cheung) [#60391](nodejs/node#60391) - \[[`c94c6555cc`](nodejs/node@c94c6555cc)] - **test,crypto**: handle a few more BoringSSL tests (Shelley Vohr) [#59030](nodejs/node#59030) - \[[`fd63c27444`](nodejs/node@fd63c27444)] - **test,crypto**: update x448 and ed448 expectation when on boringssl (Shelley Vohr) [#60387](nodejs/node#60387) - \[[`bf0de92446`](nodejs/node@bf0de92446)] - **tls**: fix leak on invalid protocol method (Shelley Vohr) [#60427](nodejs/node#60427) - \[[`7e8373b378`](nodejs/node@7e8373b378)] - **tools**: replace invalid expression in dependabot config (Riddhi) [#60649](nodejs/node#60649) - \[[`ac08760547`](nodejs/node@ac08760547)] - **tools**: extract Nix dependency lists to separate files (Antoine du Hamel) [#60495](nodejs/node#60495) - \[[`ae91a6cc3a`](nodejs/node@ae91a6cc3a)] - **tools**: only add test reporter args when node:test is used (Joyee Cheung) [#60551](nodejs/node#60551) - \[[`97ed560222`](nodejs/node@97ed560222)] - **tools**: skip unaffected GHA jobs for changes in `test/internet` (Antoine du Hamel) [#60517](nodejs/node#60517) - \[[`44ca97b404`](nodejs/node@44ca97b404)] - **tools**: fix update-icu script (Michaël Zasso) [#60521](nodejs/node#60521) - \[[`07b0b5a5ba`](nodejs/node@07b0b5a5ba)] - **tools**: fix linter for semver-major release proposals (Antoine du Hamel) [#60481](nodejs/node#60481) - \[[`97d74224c3`](nodejs/node@97d74224c3)] - **tools**: fix failing release-proposal linter for LTS transitions (Antoine du Hamel) [#60465](nodejs/node#60465) - \[[`019af5bc27`](nodejs/node@019af5bc27)] - **tools**: skip running test-shared on deps changes (Antoine du Hamel) [#60433](nodejs/node#60433) - \[[`3ec9764151`](nodejs/node@3ec9764151)] - **tools**: pin OpenSSL to 3.5.4 on test-shared workflow (Antoine du Hamel) [#60428](nodejs/node#60428) - \[[`fe2d6d44d4`](nodejs/node@fe2d6d44d4)] - **tools**: remove undici from daily wpt.fyi job (Filip Skokan) [#60444](nodejs/node#60444) - \[[`d09ba98398`](nodejs/node@d09ba98398)] - **tools**: document that nixpkgs updates should not be backported (Antoine du Hamel) [#60431](nodejs/node#60431) - \[[`7fc99319e7`](nodejs/node@7fc99319e7)] - **tools**: do not use short hashes for deps versioning to avoid collision (Antoine du Hamel) [#60407](nodejs/node#60407) - \[[`815edb0c3a`](nodejs/node@815edb0c3a)] - **tools,doc**: update JavaScript primitive types to match MDN Web Docs (JustApple) [#60581](nodejs/node#60581) - \[[`6877139a2d`](nodejs/node@6877139a2d)] - **util**: fix stylize of special properties in inspect (Ge Gao) [#60479](nodejs/node#60479) - \[[`399b340022`](nodejs/node@399b340022)] - **(SEMVER-MINOR)** **v8**: adding total\_allocated\_bytes to HeapStatistics (Caio Lima) [#60573](nodejs/node#60573) - \[[`d64795b318`](nodejs/node@d64795b318)] - **watch**: fix interaction with multiple env files (Marco Ippolito) [#60605](nodejs/node#60605) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

Bun's `src/jsc/bindings/ncrypto.{cpp,h}` is a port of [nodejs/ncrypto@134ac40](nodejs/ncrypto@134ac40) (February 2025), which maps to Node's `deps/ncrypto` from late January 2025. This ports the upstream correctness fixes made since then that apply to code Bun already has, plus one Bun-local typo found while auditing the drift. ### Upstream fixes | Change | Upstream | | --- | --- | | `DataPointer::resize()`: handle `OPENSSL_realloc` failure instead of returning a `DataPointer` with a null pointer and a nonzero length. Also frees the old block on failure. Upstream's version calls a `free()` helper after `release()` has already nulled `data_`, which is a no-op, so the old block leaks; this keeps the intent without that. | [nodejs/ncrypto#37](nodejs/ncrypto#37) | | `CipherCtxPointer::{setIvLength, setAeadTag, setAeadTagLength, getAeadTag}`: compare the `EVP_CIPHER_CTX_ctrl` return against `> 0`. The raw `int` can be negative, which converts to `true`. BoringSSL normalizes `-1` to `0`, so this is masked in Bun's build today, but it is still the wrong check. | [nodejs/ncrypto#36](nodejs/ncrypto#36) | | `BignumPointer::{GetWord, getWord}` return `std::optional` so a `BN_get_word` overflow (reported as the all-ones word) is distinguishable from the real all-ones value. The optional wraps `BN_ULONG`, not upstream's `unsigned long`: BoringSSL's `BN_ULONG` is `uint64_t` on every 64-bit target, so `unsigned long` would still silently truncate 33-to-64-bit values on LLP64 (Windows x64). | [nodejs/node#63895](nodejs/node#63895) | | `BIOPointer::New(method)`: return an empty pointer for a null method. | [nodejs/node#61788](nodejs/node#61788) | | `EVPKeyCtxPointer::publicCheck()`: remove an unconditional return that made the `EVP_PKEY_public_check_quick` branch unreachable. The whole block is non-BoringSSL, so it is dead in Bun's build. | [nodejs/node#59471](nodejs/node#59471) | | `X509Name::Iterator::operator*()`: free the buffer allocated by `ASN1_STRING_to_UTF8`, and return early on a negative size (the out-pointer is never written on failure). Dead code today: `JSX509Certificate.cpp` has its own correct loop. | [nodejs/node#60609](nodejs/node#60609) | ### `GetWord` callers updated - `JSDiffieHellmanConstructor.cpp`: the generator-below-2 check becomes `has_value() && *word < 2`. This is the one spot that needed care: `std::optional<T> < 2` compiles and evaluates `nullopt < 2` as `true`, so a naive translation would have started rejecting any generator wider than a word. - `JSX509Certificate.cpp` (both legacy-object sites): `exponent` is reported as `null` when the RSA public exponent does not fit in a word, matching Node. This branch is unreachable under BoringSSL, which rejects RSA public exponents wider than 33 bits at SPKI parse time. ### Bun-local typo `SSLCtxPointer::setCipherSuites` passed `ciphers.length()` where `SSL_CTX_set_ciphersuites` expects the string. It is in the non-BoringSSL `#ifndef` branch so it never compiles in Bun's build; introduced by the original `WTF::StringView` port of the file. ### Testing No test here can fail against the unmodified source on a Linux machine, because nothing in this diff changes observable behavior on Linux. I checked each one: `DataPointer::resize` only diverges under `OPENSSL_realloc` failure, the `EVP_CIPHER_CTX_ctrl` returns are already normalized to `0` or `1` by BoringSSL, `publicCheck` and `setCipherSuites` are inside non-BoringSSL `#ifndef` branches, `BIOPointer::New(method)` and `X509Name::Iterator` have no callers, and `BN_ULONG` and `unsigned long` are the same 64-bit type on LP64. The one real before-and-after is the `BN_ULONG` truncation, and it only exists on Windows x64 (LLP64). So the new tests pin invariants rather than prove a failure. `node-crypto.test.js` gains three `DiffieHellman` cases: - A 72-bit buffer generator is accepted. This is what a naive `optional < 2` translation would have broken on every platform. - A 33-bit (5-byte) buffer generator is accepted. Equivalent on platforms with a 64-bit `unsigned long`; on Windows x64 the `unsigned long` version of this change truncates it to `0` and wrongly rejects it as below 2, so this is the real regression test for the `BN_ULONG` return type on that platform. - Generators below 2 are still rejected and exactly 2 is still accepted. Node v26 agrees on all three. <details> <summary>Local verification against the debug build</summary> - `test/js/node/crypto/{crypto,node-crypto,crypto.key-objects,crypto-rsa,x509-subclass}.test.*`: 677 pass, 0 fail - `test/js/node/test/parallel/test-crypto-{x509,dh,dh-errors,dh-constructor,dh-odd-key,dh-generate-keys,dh-shared,dh-padding,cipheriv-decipheriv,gcm-explicit-short-tag,gcm-implicit-short-tag,aes-wrap,padding-aes256,getcipherinfo,rsa-dsa}.js`, `test-webcrypto-encrypt-decrypt-aes.js`, `test-crypto-webcrypto-aes-decrypt-tag-too-small.js`: all pass </details> ### Deliberately not included - `Cipher::MAX_AUTH_TAG_LENGTH` ([nodejs/node#57803](nodejs/node#57803)): of the three macros upstream's `static_assert` uses, BoringSSL only defines `EVP_GCM_TLS_TAG_LEN`, so the assert degenerates to `16 <= 16`. - `ECKeyPointer::setPublicKeyRaw` ([nodejs/node#62396](nodejs/node#62396)): the expensive check that rewrite avoids (the `order * Q == infinity` step of `EC_KEY_check_key`) does not exist in BoringSSL's `EC_KEY_check_key`, so there is no perf win for Bun. - The BoringSSL build guards the standalone repo added (`NCRYPTO_NO_DSA_KEYGEN`, `NCRYPTO_NO_EVP_DH`, rejecting DSA in `NewFromID`, ...): those exist for vanilla BoringSSL CI, and Bun's DSA and DH paths work today against its BoringSSL. --------- Co-authored-by: Dylan Conway <dylan.conway567@gmail.com>

RafaelGSS marked this pull request as ready for review November 6, 2025 20:23

nodejs-github-bot added dependencies Pull requests that update a dependency file. needs-ci PRs that need a full CI run. labels Nov 6, 2025

RafaelGSS added fast-track PRs that do not need to wait for 48 hours to land. and removed needs-ci PRs that need a full CI run. dependencies Pull requests that update a dependency file. labels Nov 6, 2025

RafaelGSS force-pushed the fix-leak-ANS1_STRING_to_UTF8 branch from e06e579 to 615f5cd Compare November 6, 2025 20:30

smithc reviewed Nov 6, 2025

View reviewed changes

Comment thread deps/ncrypto/ncrypto.cc Outdated

smithc reviewed Nov 6, 2025

View reviewed changes

Comment thread deps/ncrypto/ncrypto.cc Outdated

mcollina approved these changes Nov 7, 2025

View reviewed changes

deps: call OPENSSL_free after ANS1_STRING_to_UTF8

60adee1

Co-Authored-By: Chris Smith <chrismith@vista.com> Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>

RafaelGSS force-pushed the fix-leak-ANS1_STRING_to_UTF8 branch from 64ce4c4 to 60adee1 Compare November 7, 2025 13:36

marco-ippolito approved these changes Nov 7, 2025

View reviewed changes

RafaelGSS mentioned this pull request Nov 7, 2025

src: more ncrypto #56792

Closed

jasnell approved these changes Nov 7, 2025

View reviewed changes

RafaelGSS added the request-ci Add this label to start a Jenkins CI on a PR. label Nov 7, 2025

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Nov 7, 2025

lpinca approved these changes Nov 7, 2025

View reviewed changes

juanarbol approved these changes Nov 7, 2025

View reviewed changes

aduh95 added the needs-ci PRs that need a full CI run. label Nov 8, 2025

RafaelGSS added commit-queue Add this label to land a pull request using GitHub Actions. lts-watch-v24.x PRs that may need to be released in v24.x labels Nov 10, 2025

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Nov 10, 2025

nodejs-github-bot merged commit 5e1ab9f into nodejs:main Nov 10, 2025
71 of 74 checks passed

github-actions Bot mentioned this pull request Nov 11, 2025

2025-11-11, Version 25.2.0 (Current) #60677

Merged

github-actions Bot mentioned this pull request Dec 9, 2025

2025-12-10, Version 24.12.0 'Krypton' (LTS) #61001

Merged

aduh95 removed the lts-watch-v24.x PRs that may need to be released in v24.x label Feb 22, 2026

robobun mentioned this pull request Jul 1, 2026

crypto: port upstream ncrypto correctness fixes oven-sh/bun#33202

Merged

deps: call OPENSSL_free after ANS1_STRING_to_UTF8 by RafaelGSS · Pull Request #60609 · nodejs/node · GitHub

Uh oh!

Uh oh!

deps: call OPENSSL_free after ANS1_STRING_to_UTF8 - #60609

deps: call OPENSSL_free after ANS1_STRING_to_UTF8#60609
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
RafaelGSS:fix-leak-ANS1_STRING_to_UTF8

RafaelGSS commented Nov 6, 2025 •
edited
Loading

Uh oh!

Uh oh!

nodejs-github-bot commented Nov 6, 2025

Uh oh!

github-actions Bot commented Nov 6, 2025

Uh oh!

Uh oh!

Uh oh!

mcollina left a comment

Uh oh!

nodejs-github-bot commented Nov 7, 2025

Uh oh!

nodejs-github-bot commented Nov 7, 2025

Uh oh!

Uh oh!

nodejs-github-bot commented Nov 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

deps: call OPENSSL_free after ANS1_STRING_to_UTF8 by RafaelGSS · Pull Request #60609 · nodejs/node · GitHub

Uh oh!

Uh oh!

deps: call OPENSSL_free after ANS1_STRING_to_UTF8 - #60609

deps: call OPENSSL_free after ANS1_STRING_to_UTF8#60609nodejs-github-bot merged 1 commit intonodejs:mainnodejs/node:mainfrom RafaelGSS:fix-leak-ANS1_STRING_to_UTF8RafaelGSS/node:fix-leak-ANS1_STRING_to_UTF8Copy head branch name to clipboard

Conversation

RafaelGSS commented Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Nov 6, 2025

Uh oh!

github-actions Bot commented Nov 6, 2025

Uh oh!

Uh oh!

Uh oh!

mcollina left a comment

Choose a reason for hiding this comment

Uh oh!

nodejs-github-bot commented Nov 7, 2025

Uh oh!

nodejs-github-bot commented Nov 7, 2025

Uh oh!

Uh oh!

nodejs-github-bot commented Nov 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

deps: call OPENSSL_free after ANS1_STRING_to_UTF8#60609
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
RafaelGSS:fix-leak-ANS1_STRING_to_UTF8

RafaelGSS commented Nov 6, 2025 •
edited
Loading