Windows: fs calls abort the process on a path containing U+10FFFF (libuv assert, fixed in libuv 1.52.0 but not in v22/v25)

Beginne mit der Ausführung der Windows-Dateisystem-Reproduktion mit String.fromCodePoint(0x10FFFF), untersuche anschließend deps/uv/src/idna.c und den durch den libuv-Commit 73bfbb9 hinzugefügten Regressionstest. Prüfe den v22-Updatepfad für die gebündelte libuv oder den Backport-Pfad und verifiziere, dass derselbe Aufruf nicht mehr abbricht, sondern stattdessen das normale Verhalten bei Dateisystemfehlern zurückgibt.

Version

v22.15.0 (also affects v22.23.2, v25.9.0, v20.x by bundled-libuv version)

Platform

Microsoft Windows NT 10.0.26200.0 x64

Subsystem

fs

What steps will reproduce the bug?

require('fs').existsSync(String.fromCodePoint(0x10FFFF))

Output:

Assertion failed: code_point < 0x10FFFF, file c:\ws\deps\uv\src\idna.c, line 397

Exit code 127. The process is aborted, not an exception.

statSync and readFileSync behave identically. It is not catchable:

try { require('fs').statSync(String.fromCodePoint(0x10FFFF)); }
catch (e) { console.log('caught:', e.code); }
console.log('reached end');   // never printed

Control — the neighbouring code point is handled correctly:

require('fs').existsSync(String.fromCodePoint(0x10FFFE))   // returns false

U+10FFFD is likewise fine. Only U+10FFFF, the maximum legal Unicode scalar value, aborts.

How often does it reproduce? Is there a required condition?

Every time, on Windows. The path need not exist — the abort happens during the UTF-8 → UTF-16 path conversion, before any filesystem access.

What is the expected behavior? Why is that the expected behavior?

ENOENT (or any throw), as with every other non-existent path. U+10FFFF is a valid Unicode scalar value and a legal character in a JS string, so it can arrive from any untrusted input that is used as a path.

The important part is not that it fails, but that it fails un-catchably. A library cannot defend itself with try/catch, so any code that stats or reads a caller-supplied path can have its process killed. That is a denial-of-service vector for anything that takes a path from user input, a config file, or a network request.

What do you see instead?

The process aborts with the libuv assertion above.

Additional information

This is already fixed in libuv, but the fix has not reached all Node release lines.

libuv commit 73bfbb9 — "idna: fix assert in wtf8_to_utf16 conversion" (libuv#5021, 2026-02-04) — corrects an off-by-one in uv_wtf8_to_utf16:

      if (code_point > 0xFFFF) {
-       assert(code_point < 0x10FFFF);
+       assert(code_point <= 0x10FFFF);

It also adds a regression test for exactly this input ("\xF4\x8F\xBF\xBF").

That fix first shipped in libuv v1.52.0 (2026-02-11). Bundled libuv by Node release line:

line	latest	bundled libuv	affected
v26	26.7.0	1.52.1	no
v25	25.9.0	1.51.0	yes
v24	24.19.0	1.52.1	no
v22 (LTS)	22.23.2	1.51.0	yes
v20	20.20.2	1.46.0	yes

So current v22 LTS is still affected, which is the reason for this report — v24 and v26 already carry the fix.

Reproduced directly on v22.15.0 (libuv 1.49.2). v22.23.2, v25.9.0 and v20.x are identified as affected from the bundled libuv version and the commit's release tag rather than executed on each line.

Would a libuv update (or a backport of this one-line change) to the v22 line be in scope? Happy to open the PR if that is the preferred route.

Found when a property-based test in a downstream project generated arbitrary strings and killed the test worker with no assertion output, roughly one run in five.