Harden 36 reachable security findings across runtime, install, parsers, http

src/dotenv/env_loader.rs

@@ -1448,12 +1448,18 @@ impl Map {
         let mut i: usize = 0;
         let mut it = self.map.iterator();
         while let Some(pair) = it.next() {
+            if i + pair.key_ptr.len() + 7 >= result.len() {
+                return Err(bun_core::Error::from_name("TooManyEnvironmentVariables"));
+            }
             i += strings::convert_utf8_to_utf16_in_buffer(&mut result[i..], pair.key_ptr).len();
             if i + 7 >= result.len() {
                 return Err(bun_core::Error::from_name("TooManyEnvironmentVariables"));
             }
             result[i] = b'=' as u16;
             i += 1;
+            if i + pair.value_ptr.value.len() + 5 >= result.len() {
+                return Err(bun_core::Error::from_name("TooManyEnvironmentVariables"));
+            }
             i += strings::convert_utf8_to_utf16_in_buffer(&mut result[i..], &pair.value_ptr.value)
                 .len();
             if i + 5 >= result.len() {

src/http/HTTPContext.rs

@@ -170,6 +170,12 @@ pub struct PooledSocket<const SSL: bool> {
     pub port: u16,
     /// If you set `rejectUnauthorized` to `false`, the connection fails to verify,
     pub did_have_handshaking_error_while_reject_unauthorized_is_false: bool,
+    /// True if the TLS handshake for this socket ran with
+    /// `rejectUnauthorized=true` (i.e. `checkServerIdentity` was enforced).
+    /// A socket established with `rejectUnauthorized=false` never validated the
+    /// peer hostname, so a strict caller must not reuse it even when the chain
+    /// itself was CA-valid (`did_have_handshaking_error` stays false).
+    pub established_with_reject_unauthorized: bool,
     /// The interned SSLConfig this socket was created with (None = default context).
     /// Owns a strong ref while the socket is in the keepalive pool.
     pub ssl_config: Option<ssl_config::SharedPtr>,
@@ -606,6 +612,7 @@ impl<const SSL: bool> HTTPContext<SSL> {
         &mut self,
         socket: HTTPSocket<SSL>,
         did_have_handshaking_error_while_reject_unauthorized_is_false: bool,
+        established_with_reject_unauthorized: bool,
         hostname: &[u8],
         port: u16,
         ssl_config: Option<&ssl_config::SharedPtr>,
@@ -660,6 +667,7 @@ impl<const SSL: bool> HTTPContext<SSL> {
                     hostname_len: hostname.len() as u8, // @truncate
                     port,
                     did_have_handshaking_error_while_reject_unauthorized_is_false,
+                    established_with_reject_unauthorized,
                     // Clone a strong ref for the keepalive pool; the caller retains
                     // its own ref via HTTPClient.tls_props.
                     ssl_config: ssl_config.cloned(),
@@ -786,6 +794,17 @@ impl<const SSL: bool> HTTPContext<SSL> {
                 {
                     continue;
                 }
+            } else if SSL
+                // Same failure mode as the tunnel branch above, for direct
+                // HTTPS sockets: a socket established with
+                // reject_unauthorized=false never ran checkServerIdentity, so
+                // a CA-valid wrong-hostname cert leaves
+                // did_have_handshaking_error=false and the outer guard passes.
+                // Block a strict caller from reusing it.
+                && reject_unauthorized
+                && !socket.established_with_reject_unauthorized
+            {
+                continue;
             }
 
             if strings::eql_long(
@@ -904,14 +923,28 @@ impl<const SSL: bool> HTTPContext<SSL> {
                     // the centralised [`h2_session_as_mut`] accessor — same
                     // strong-ref-held invariant as the pool/found-slot cases.
                     let s = h2_session_as_mut(NonNull::new(session)).unwrap();
-                    if s.has_headroom() && s.matches(hostname, port, cfg) {
+                    if s.has_headroom()
+                        && s.matches(hostname, port, cfg)
+                        // Same guard as the pool path: a session whose TLS
+                        // handshake ran with reject_unauthorized=false never
+                        // validated the peer hostname, so a strict caller
+                        // must not multiplex onto it.
+                        && (!client.flags.reject_unauthorized
+                            || s.established_with_reject_unauthorized)
+                    {
                         s.adopt(client);
                         return Ok(None);
                     }
                 }
                 let cfg_nn = cfg.and_then(|p| NonNull::new(p.cast_mut()));
                 for pc in &mut self.pending_h2_connects {
-                    if pc.matches(hostname, port, cfg_nn) {
+                    // Same strictness guard as the active-session loop above: a
+                    // strict caller must not coalesce onto an in-flight connect
+                    // that was initiated with reject_unauthorized=false, since
+                    // the resulting session won't have validated the peer.
+                    if pc.matches(hostname, port, cfg_nn)
+                        && (!client.flags.reject_unauthorized || pc.reject_unauthorized)
+                    {
                         // client outlives the pending connect (resolved before
                         // its terminal callback fires).
                         pc.waiters.push(client.as_erased_ptr());
@@ -1036,6 +1069,7 @@ impl<const SSL: bool> HTTPContext<SSL> {
                     hostname: Box::<[u8]>::from(hostname),
                     port,
                     ssl_config: cfg,
+                    reject_unauthorized: client.flags.reject_unauthorized,
                     ..Default::default()
                 });
                 // `client.pending_h2 = pc` stores a *borrowed* backref into the

src/http/h2_client/ClientSession.rs

@@ -49,6 +49,10 @@ pub struct ClientSession {
     pub port: u16,
     pub ssl_config: Option<ssl_config::SharedPtr>,
     pub did_have_handshaking_error: bool,
+    /// True if the TLS handshake ran with `rejectUnauthorized=true`. Carried
+    /// into the keepalive pool so a strict caller never reuses a session whose
+    /// hostname was never validated.
+    pub established_with_reject_unauthorized: bool,
 
     /// Queued bytes for the socket; whole frames are written here and
     /// `flush()` drains as much as the socket accepts.
@@ -234,6 +238,7 @@ impl ClientSession {
             port: client.connected_url.get_port_auto(),
             ssl_config: client.tls_props.clone(),
             did_have_handshaking_error: client.flags.did_have_handshaking_error,
+            established_with_reject_unauthorized: client.flags.reject_unauthorized,
             write_buffer: bun_io::StreamBuffer::default(),
             read_buffer: Vec::new(),
             streams: ArrayHashMap::default(),
@@ -895,6 +900,7 @@ impl ClientSession {
             HTTPClient::ssl_ctx_mut(self.ctx).release_socket(
                 self.socket,
                 self.did_have_handshaking_error,
+                self.established_with_reject_unauthorized,
                 &self.hostname,
                 self.port,
                 self.ssl_config.as_ref(),

src/http/h2_client/PendingConnect.rs

@@ -17,6 +17,12 @@ pub struct PendingConnect {
     pub port: u16,
     // TODO(port): lifetime — compared by pointer identity only, never derefed/freed here
     pub ssl_config: Option<NonNull<SSLConfig>>,
+    /// Whether the client that initiated this in-flight TLS connect requested
+    /// `rejectUnauthorized`. The eventual `ClientSession` records this as
+    /// `established_with_reject_unauthorized`; mirroring it here lets the
+    /// coalescing path apply the same strictness guard *before* the session
+    /// exists, so a strict caller never waits on a connect started by a lax one.
+    pub reject_unauthorized: bool,
     // BACKREF: waiters are borrowed HTTP clients owned elsewhere; lifetime-erased.
     pub waiters: Vec<NonNull<HTTPClient<'static>>>,
 }
@@ -27,6 +33,7 @@ impl Default for PendingConnect {
             hostname: Box::default(),
             port: 0,
             ssl_config: None,
+            reject_unauthorized: false,
             waiters: Vec::new(),
         }
     }

src/http/lib.rs

@@ -2315,6 +2315,7 @@ impl<'a> HTTPClient<'a> {
             Self::ssl_ctx_mut(ctx).release_socket(
                 socket,
                 self.flags.did_have_handshaking_error && !self.flags.reject_unauthorized,
+                self.flags.reject_unauthorized,
                 self.connected_url.hostname,
                 self.connected_url.get_port_auto(),
                 self.tls_props.as_ref(),
@@ -3591,6 +3592,7 @@ impl<'a> HTTPClient<'a> {
                 Self::ssl_ctx_mut(ctx).release_socket(
                     socket,
                     self.flags.did_have_handshaking_error && !self.flags.reject_unauthorized,
+                    self.flags.reject_unauthorized,
                     self.connected_url.hostname,
                     self.connected_url.get_port_auto(),
                     self.tls_props.as_ref(),
@@ -3812,6 +3814,7 @@ impl<'a> HTTPClient<'a> {
         Self::ssl_ctx_mut(ctx).release_socket(
             socket,
             self.flags.did_have_handshaking_error && !self.flags.reject_unauthorized,
+            self.flags.reject_unauthorized,
             self.url.hostname,
             self.url.get_port_auto(),
             self.tls_props.as_ref(),

src/http_jsc/websocket_client.rs

@@ -287,15 +287,13 @@ impl<const SSL: bool> WebSocket<SSL> {
             if reject_unauthorized {
                 // Check for SSL errors
                 if ssl_error.error_no != 0 {
-                    self.outgoing_websocket = None;
-                    ws_ref.did_abrupt_close(ErrorCode::FailedToConnect);
+                    self.fail(ErrorCode::FailedToConnect);
                     return;
                 }
 
                 // Check authorization status
                 if !authorized {
-                    self.outgoing_websocket = None;
-                    ws_ref.did_abrupt_close(ErrorCode::FailedToConnect);
+                    self.fail(ErrorCode::FailedToConnect);
                     return;
                 }
 
@@ -317,8 +315,8 @@ impl<const SSL: bool> WebSocket<SSL> {
                     if !ssl_ptr.is_null()
                         && !boringssl::check_server_identity(unsafe { &mut *ssl_ptr }, hostname)
                     {
-                        self.outgoing_websocket = None;
-                        ws_ref.did_abrupt_close(ErrorCode::FailedToConnect);
+                        self.fail(ErrorCode::FailedToConnect);
+                        return;
                     }
                 }
             }
@@ -1322,6 +1320,10 @@ impl<const SSL: bool> WebSocket<SSL> {
     }
 
     fn send_close_with_body(&mut self, code: u16, body: Option<&mut [u8; 125]>, body_len: usize) {
+        // RFC 6455 §5.5: control-frame payloads are capped at 125 bytes total,
+        // and a close-frame payload starts with the 2-byte status code, so the
+        // reason text is limited to 123 bytes.
+        let body_len = body_len.min(123);
         log!("Sending close with code {}", code);
         if !self.has_tcp() {
             self.dispatch_abrupt_close(ErrorCode::Ended);
@@ -1667,6 +1669,10 @@ impl<const SSL: bool> WebSocket<SSL> {
                     cursor.set_position((pos + result.written as usize) as u64);
                 }
                 let wrote_len = cursor.position() as usize;
+                // 125-byte close-frame payload budget minus the 2-byte status code.
+                if wrote_len > 123 {
+                    break 'inner;
+                }
                 // SAFETY: close_reason_buf has 128 bytes; reinterpret first 125 as fixed array
                 let buf_ptr = close_reason_buf.as_mut_ptr().cast::<[u8; 125]>();
                 this.send_close_with_body(code, Some(unsafe { &mut *buf_ptr }), wrote_len);

src/install/bin.rs

@@ -781,9 +781,16 @@ static HAS_SET_UMASK: AtomicBool = AtomicBool::new(false);
 
 impl<'a> Linker<'a> {
     pub fn ensure_umask() {
-        if !HAS_SET_UMASK.load(Ordering::Acquire) {
-            HAS_SET_UMASK.store(true, Ordering::Release);
-            UMASK.store(sys::umask(0) as u32, Ordering::Release);
+        // Single-winner gate: only the thread that flips false->true performs
+        // the temporary umask(0)/umask(prev) probe. A bare load+store would let
+        // two threads interleave the probe and leave the process umask wrong.
+        if HAS_SET_UMASK
+            .compare_exchange(false, true, Ordering::AcqRel, Ordering::Acquire)
+            .is_ok()
+        {
+            let prev = sys::umask(0);
+            sys::umask(prev);
+            UMASK.store(prev as u32, Ordering::Release);
         }
     }
 
@@ -1269,7 +1276,7 @@ impl<'a> Linker<'a> {
     fn chmod_on_ok(err: &Option<Error>, abs_target: &ZStr) {
         // PORT NOTE: hoisted from `defer` block in create_symlink
         if err.is_none() {
-            let _ = sys::chmod(abs_target, UMASK.load(Ordering::Acquire) as Mode | 0o777);
+            let _ = sys::chmod(abs_target, 0o777 & !(UMASK.load(Ordering::Acquire) as Mode));
         }
     }
 
@@ -1444,6 +1451,12 @@ impl<'a> Linker<'a> {
                         ZStr::from_raw(r.as_bytes().as_ptr(), r.len())
                     };
 
+                    if unscoped_package_name.len()
+                        >= self.abs_dest_buf.len().saturating_sub(dest_off)
+                    {
+                        self.err = Some(bun_core::err!("NameTooLong"));
+                        return;
+                    }
                     self.abs_dest_buf[dest_off..dest_off + unscoped_package_name.len()]
                         .copy_from_slice(unscoped_package_name);
                     dest_off += unscoped_package_name.len();
@@ -1596,6 +1609,12 @@ impl<'a> Linker<'a> {
                                     ZStr::from_raw(r.as_bytes().as_ptr(), r.len())
                                 };
 
+                                if entry_name.len()
+                                    >= self.abs_dest_buf.len().saturating_sub(abs_dest_dir_end)
+                                {
+                                    self.err = Some(bun_core::err!("NameTooLong"));
+                                    return;
+                                }
                                 dest_off = abs_dest_dir_end;
                                 self.abs_dest_buf[dest_off..dest_off + entry_name.len()]
                                     .copy_from_slice(entry_name);
@@ -1633,6 +1652,12 @@ impl<'a> Linker<'a> {
                 Tag::File => {
                     let unscoped_package_name =
                         Dependency::unscoped_package_name(self.package_name.slice());
+                    if unscoped_package_name.len()
+                        >= self.abs_dest_buf.len().saturating_sub(dest_off)
+                    {
+                        self.err = Some(bun_core::err!("NameTooLong"));
+                        return;
+                    }
                     self.abs_dest_buf[dest_off..dest_off + unscoped_package_name.len()]
                         .copy_from_slice(unscoped_package_name);
                     dest_off += unscoped_package_name.len();
@@ -1649,6 +1674,12 @@ impl<'a> Linker<'a> {
                     if normalized_name.is_empty() {
                         return;
                     }
+                    if normalized_name.len()
+                        >= self.abs_dest_buf.len().saturating_sub(dest_off)
+                    {
+                        self.err = Some(bun_core::err!("NameTooLong"));
+                        return;
+                    }
 
                     self.abs_dest_buf[dest_off..dest_off + normalized_name.len()]
                         .copy_from_slice(normalized_name);
@@ -1672,6 +1703,12 @@ impl<'a> Linker<'a> {
                             i += 2;
                             continue;
                         }
+                        if normalized_bin_dest.len()
+                            >= self.abs_dest_buf.len().saturating_sub(abs_dest_dir_end)
+                        {
+                            self.err = Some(bun_core::err!("NameTooLong"));
+                            return;
+                        }
 
                         dest_off = abs_dest_dir_end;
                         self.abs_dest_buf[dest_off..dest_off + normalized_bin_dest.len()]
@@ -1714,6 +1751,12 @@ impl<'a> Linker<'a> {
                         match entry.kind {
                             sys::EntryKind::SymLink | sys::EntryKind::File => {
                                 let entry_name = entry.name.slice_u8();
+                                if entry_name.len()
+                                    >= self.abs_dest_buf.len().saturating_sub(abs_dest_dir_end)
+                                {
+                                    self.err = Some(bun_core::err!("NameTooLong"));
+                                    return;
+                                }
                                 dest_off = abs_dest_dir_end;
                                 self.abs_dest_buf[dest_off..dest_off + entry_name.len()]
                                     .copy_from_slice(entry_name);

src/install/dependency.rs

@@ -680,9 +680,15 @@ impl VersionExt for Version {
         let slice = String {
             bytes: bytes[1..9].try_into().expect("infallible: size matches"),
         };
+        if !slice.is_inline() {
+            let ptr = slice.ptr();
+            if (ptr.off as usize).saturating_add(ptr.len as usize) > ctx.buffer.len() {
+                return Version::default();
+            }
+        }
         // bytes[0] was written by `to_external` from a valid `Tag`; decode by
-        // exhaustive match so a corrupt lockfile byte traps instead of
-        // producing an invalid discriminant.
+        // exhaustive match so a corrupt lockfile byte degrades to an
+        // uninitialized version (and a logged error) instead of aborting.
         let tag: Tag = match bytes[0] {
             0 => Tag::Uninitialized,
             1 => Tag::Npm,
@@ -694,7 +700,14 @@ impl VersionExt for Version {
             7 => Tag::Git,
             8 => Tag::Github,
             9 => Tag::Catalog,
-            n => unreachable!("invalid Dependency.Version.Tag {n}"),
+            n => {
+                ctx.log.add_error_fmt(
+                    None,
+                    bun_ast::Loc::EMPTY,
+                    format_args!("Corrupt lockfile: invalid dependency version tag {n}"),
+                );
+                Tag::Uninitialized
+            }
         };
         let sliced = slice.sliced(ctx.buffer);
         parse_with_tag(