[v24.x] lib: backport _tls_common and _tls_wrap refactors by targos · Pull Request #61044 · nodejs/node

targos

mentioned this pull request

Dec 13, 2025

nodejs-github-bot added lib / src

needs-ci

v24.x

labels

Dec 13, 2025

aduh95 pushed a commit to targos/node that referenced this pull request

Feb 4, 2026

This is the same as the original change, minus the `process.emitWarning`
calls and unit tests that expect the deprecation warnings, plus
re-application of the fixes for CVE-2025-59465 and CVE-2026-21637.

Original commit message:
    lib: deprecate _tls_common and _tls_wrap

    runtime deprecate the _tls_common and _tls_wrap
    modules, users should use nust node:tls insteal
    and internally internal/tls/commond and
    internal/tls/wrap should be used instead

PR-URL: nodejs#57643
Backport-PR-URL: nodejs#61044
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

aduh95 pushed a commit to targos/node that referenced this pull request

Feb 4, 2026

aduh95 pushed a commit to targos/node that referenced this pull request

Feb 4, 2026

This is the same as the original change, minus the `process.emitWarning`
calls and unit tests that expect the deprecation warnings, plus
re-application of the fixes for CVE-2025-59465 and CVE-2026-21637.

Original commit message:
    lib: deprecate _tls_common and _tls_wrap

    runtime deprecate the _tls_common and _tls_wrap
    modules, users should use nust node:tls insteal
    and internally internal/tls/commond and
    internal/tls/wrap should be used instead

PR-URL: nodejs#57643
Backport-PR-URL: nodejs#61044
Co-authored-by: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <targos@protonmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

aduh95 pushed a commit that referenced this pull request

Feb 6, 2026

This is the same as the original change, minus the `process.emitWarning`
calls and unit tests that expect the deprecation warnings, plus
re-application of the fixes for CVE-2025-59465 and CVE-2026-21637.

Original commit message:
    lib: deprecate _tls_common and _tls_wrap

    runtime deprecate the _tls_common and _tls_wrap
    modules, users should use nust node:tls insteal
    and internally internal/tls/commond and
    internal/tls/wrap should be used instead

PR-URL: #57643
Backport-PR-URL: #61044
Co-authored-by: =?UTF-8?q?Micha=C3=ABl=20Zasso?= <targos@protonmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

aduh95 pushed a commit that referenced this pull request

Feb 6, 2026

This prevents the server from crashing due to an unhandled rejection
when a TLSSocket connection is abruptly destroyed during initialization
and the user has not attached an error handler to the socket.
e.g:

```js
const server = http2.createSecureServer({ ... })
server.on('secureConnection', socket => {
  socket.on('error', err => {
    console.log(err)
  })
})
```

PR-URL: nodejs-private/node-private#750
Backport-PR-URL: #61044
Fixes: #44751
Refs: https://hackerone.com/bugs?subject=nodejs&report_id=3262404
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
CVE-ID: CVE-2025-59465
Refs: #57643

aduh95 pushed a commit that referenced this pull request

Feb 6, 2026