Node.js: SQLite Reentrancy Bugs and a Wave of Security Hardening
Three separate contributors independently found and fixed the same class of bug in node colon SQLite, where a user-supplied getter could close a database mid-call and crash the process, while a parallel batch of crypto and permission fixes tightened spec compliance across the board.
Duration: PT2M37S
Episode overview
This episode is a short developer briefing from Node.js.
It explains recent repository work in plain language.
- Show: Node.js
- Published: 2026-08-28T13:07:25Z
- Audio duration: PT2M37S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning. It's August 28th, and today's biggest signal is a bug pattern that showed up three times independently in the SQLite module.
PRs 65449, 65595, and 65591 all target the same root problem: SQLite methods check that a database or session is open, then read an options object. If that options object has a getter, arbitrary JavaScript can run during that read — including code that closes the connection. The result was segfaults in methods like…
The second theme is spec-compliance cleanup in crypto. Filip Skokan landed a cluster of Web Crypto fixes — correcting private key SPKI export errors, RSA-PSS oversized salt handling, and JWK usage validation order — all converging on matching the exact error types and precedence the spec demands. Koreahghg's PR…
Elsewhere, hardening continues on multiple fronts. RafaelGSS's PR 65431 closes a permission model gap by blocking FileHandle fsync and fdatasync, matching restrictions already on the top-level fs API. Bitpshr's PR 65589 stops V8 from hard-crashing the process on large external memory allocations, turning a fatal…
On the feature side, Ethan Arrowood's PR 65598 adds drain and drain-sync to stream slash iter, aiming to replace…
What…
Nearby episodes from Node.js
- Closing the Gaps in Streams, Crypto, and Cleanup Order
- Crypto Gets a Major Overhaul
- Hardening Native Boundaries and Cutting File System Overhead
- Performance Tuning Across the Stack
- Weekly Recap - Performance Tuning Across the Core
- The File System Gets a Performance Overhaul
- Crypto Cleanup and Feature Flags Grow Up
- Hardening Pass Across Permissions, SQLite, and Crash Fixes