stream: disallow writing string chunk with 'buffer' encoding by Renegade334 · Pull Request #63062 · nodejs/node · GitHub

In non-object mode, Writable.prototype.write() validates the encoding as either 'buffer' or a valid string encoding.

Under default conditions, passing the encoding 'buffer' in combination with a string chunk results indirectly in an ERR_UNKNOWN_ENCODING error, because those are passed to Buffer.from() which considers the 'buffer' encoding to be invalid.

However, when decodeStrings is disabled, this indirect validation does not occur, and the string chunk is sent to the write() implementation with the encoding 'buffer', which is obviously nonsense.

semver... something?

Refs: #33075

Review requested:

@nodejs/streams

This was a test for the behaviour reported in #12152, where calling .write('string', 'buffer') on a StreamBase-backed stream would crash the process. I don't believe there's any way to hit this if this change lands, but not confidently enough to revert back to a CHECK (cf. #12753) without a second opinion – maybe Team Stream has an insight?

(cc @addaleax)

I'm fairly confident that this can't now be hit (

node/lib/internal/net.js

Lines 67 to 73 in 843dc5f

    
           if (enc !== 'buffer') 
        
             chunk = Buffer.from(chunk, enc); 
        
           this._handle.bytesWritten += chunk.length; 
        
           const ctx = {}; 
        
           writeBuffer(fd, chunk, 0, chunk.length, null, undefined, ctx);

was the offending call) so have restored the CHECK.

These tests were using the wrong constructor option name for setting the _write implementation. It doesn't matter if the error tests fail as expected, but it does make the assertion message less clear if an error test doesn't fail, as it instead complains about a missing _write implementation rather than reporting the missing expected error.

Codecov Report

❌ Patch coverage is 75.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.06%. Comparing base (c24e552) to head (b420c0f).
⚠️ Report is 49 commits behind head on main.

Files with missing lines	Patch %	Lines
src/stream_base.cc	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #63062   +/-   ##
=======================================
  Coverage   90.05%   90.06%           
=======================================
  Files         714      714           
  Lines      225247   225248    +1     
  Branches    42578    42580    +2     
=======================================
+ Hits       202842   202860   +18     
+ Misses      14181    14180    -1     
+ Partials     8224     8208   -16

Files with missing lines	Coverage Δ
lib/internal/streams/writable.js	96.38% <100.00%> (-0.25%)	⬇️
src/stream_base.cc	80.03% <0.00%> (-0.26%)	⬇️

... and 25 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>

lgtm

Commit Queue failed

- Loading data for nodejs/node/pull/63062
✔  Done loading data for nodejs/node/pull/63062
----------------------------------- PR info ------------------------------------
Title      stream: disallow writing string chunk with 'buffer' encoding (#63062)
Author     René <contact.9a5d6388@renegade334.me.uk> (@Renegade334)
Branch     Renegade334:writable-invalid-buffer-encoding -> nodejs:main
Labels     stream, baking-for-lts, needs-ci, commit-queue-squash
Commits    2
 - stream: disallow writing string chunk with 'buffer' encoding
 - stream: restore buffer CHECK assertion in StreamBase::WriteBuffer
Committers 1
 - Renegade334 <contact.9a5d6388@renegade334.me.uk>
PR-URL: https://github.com/nodejs/node/pull/63062
Refs: https://github.com/nodejs/node/pull/33075
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/63062
Refs: https://github.com/nodejs/node/pull/33075
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ethan Arrowood <ethan@arrowood.dev>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Fri, 01 May 2026 13:44:15 GMT
   ✔  Approvals: 3
   ✔  - Luigi Pinca (@lpinca): https://github.com/nodejs/node/pull/63062#pullrequestreview-4212353853
   ✔  - Ethan Arrowood (@Ethan-Arrowood): https://github.com/nodejs/node/pull/63062#pullrequestreview-4299586870
   ✔  - Matteo Collina (@mcollina) (TSC): https://github.com/nodejs/node/pull/63062#pullrequestreview-4304020488
   ✔  Last GitHub CI successful
   ✘  No Jenkins CI runs detected
--------------------------------------------------------------------------------
   ✔  Aborted `git node land` session in /home/runner/work/node/node/.ncu

https://github.com/nodejs/node/actions/runs/26031934637

CI: https://ci.nodejs.org/job/node-test-pull-request/73531/

Landed in f352556

Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk> PR-URL: #63062 Refs: #33075 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk> PR-URL: nodejs#63062 Refs: nodejs#33075 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk> PR-URL: #63062 Backport-PR-URL: #64675 Refs: #33075 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Ethan Arrowood <ethan@arrowood.dev> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

nodejs-github-bot added needs-ci PRs that need a full CI run. stream Issues and PRs related to the stream subsystem. labels May 1, 2026

Renegade334 commented May 1, 2026

View reviewed changes

lpinca approved these changes May 1, 2026

View reviewed changes

Renegade334 added 2 commits May 14, 2026 19:11

stream: disallow writing string chunk with 'buffer' encoding

c921d18

Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>

stream: restore buffer CHECK assertion in StreamBase::WriteBuffer

b420c0f

Signed-off-by: Renegade334 <contact.9a5d6388@renegade334.me.uk>

Renegade334 force-pushed the writable-invalid-buffer-encoding branch from 0a4cd53 to b420c0f Compare May 14, 2026 17:12

Renegade334 added the commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. label May 14, 2026

Renegade334 requested a review from lpinca May 14, 2026 17:18

Ethan-Arrowood approved these changes May 15, 2026

View reviewed changes

mcollina added the baking-for-lts PRs that need to wait before landing in a LTS release. label May 16, 2026

mcollina approved these changes May 16, 2026

View reviewed changes

Renegade334 added the commit-queue Add this label to land a pull request using GitHub Actions. label May 18, 2026

nodejs-github-bot added commit-queue-failed An error occurred while landing this pull request using GitHub Actions. and removed commit-queue Add this label to land a pull request using GitHub Actions. labels May 18, 2026

Renegade334 added author ready PRs that have at least one approval, no outstanding review comments, and a CI started. request-ci Add this label to start a Jenkins CI on a PR. and removed commit-queue-failed An error occurred while landing this pull request using GitHub Actions. labels May 18, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label May 18, 2026

aduh95 added the commit-queue Add this label to land a pull request using GitHub Actions. label May 19, 2026

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label May 19, 2026

nodejs-github-bot merged commit f352556 into nodejs:main May 19, 2026
93 checks passed

Renegade334 deleted the writable-invalid-buffer-encoding branch May 19, 2026 16:45

github-actions Bot mentioned this pull request May 30, 2026

2026-06-01, Version 26.3.0 (Current) #63664

Merged

aduh95 mentioned this pull request Jul 22, 2026

[v24.x backport] node:stream/iter and QUIC backports #64675

Closed

github-actions Bot mentioned this pull request Aug 21, 2026

2026-08-26, Version 24.20.0 'Krypton' (LTS) #65461

Merged

@@ @@ -31,7 +31,7 @@ function test(autoDestroy) { @@
                 {
                   const w = new Writable({
                     autoDestroy,
-                    _write() {}
+                    write() {}

stream: disallow writing string chunk with 'buffer' encoding by Renegade334 · Pull Request #63062 · nodejs/node · GitHub

Uh oh!

Uh oh!

stream: disallow writing string chunk with 'buffer' encoding - #63062

stream: disallow writing string chunk with 'buffer' encoding#63062
nodejs-github-bot merged 2 commits into
nodejs:mainfrom
Renegade334:writable-invalid-buffer-encoding

Renegade334 commented May 1, 2026

Uh oh!

nodejs-github-bot commented May 1, 2026

Uh oh!

Renegade334 May 1, 2026 •
edited
Loading

Uh oh!

Uh oh!

Renegade334 May 14, 2026

Uh oh!

Renegade334 May 1, 2026

Uh oh!

codecov Bot commented May 1, 2026 •
edited
Loading

Uh oh!

Uh oh!

mcollina left a comment

Uh oh!

nodejs-github-bot commented May 18, 2026

Uh oh!

nodejs-github-bot commented May 18, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

	if (enc !== 'buffer')
	chunk = Buffer.from(chunk, enc);

	this._handle.bytesWritten += chunk.length;

	const ctx = {};
	writeBuffer(fd, chunk, 0, chunk.length, null, undefined, ctx);

stream: disallow writing string chunk with 'buffer' encoding by Renegade334 · Pull Request #63062 · nodejs/node · GitHub

Uh oh!

Uh oh!

stream: disallow writing string chunk with 'buffer' encoding - #63062

stream: disallow writing string chunk with 'buffer' encoding#63062nodejs-github-bot merged 2 commits intonodejs:mainnodejs/node:mainfrom Renegade334:writable-invalid-buffer-encodingRenegade334/node:writable-invalid-buffer-encodingCopy head branch name to clipboard

Conversation

Renegade334 commented May 1, 2026

Uh oh!

nodejs-github-bot commented May 1, 2026

Uh oh!

Renegade334 May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Renegade334 May 14, 2026

Choose a reason for hiding this comment

Uh oh!

Renegade334 May 1, 2026

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

mcollina left a comment

Choose a reason for hiding this comment

Uh oh!

nodejs-github-bot commented May 18, 2026

Uh oh!

nodejs-github-bot commented May 18, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

stream: disallow writing string chunk with 'buffer' encoding#63062
nodejs-github-bot merged 2 commits into
nodejs:mainfrom
Renegade334:writable-invalid-buffer-encoding

Renegade334 May 1, 2026 •
edited
Loading

codecov Bot commented May 1, 2026 •
edited
Loading