Skip to content

doc: clarify callback exceptions#63939

Open
mcollina wants to merge 1 commit into
nodejs:mainfrom
mcollina:doc-security-callback-exceptions
Open

doc: clarify callback exceptions#63939
mcollina wants to merge 1 commit into
nodejs:mainfrom
mcollina:doc-security-callback-exceptions

Conversation

@mcollina

@mcollina mcollina commented Jun 16, 2026

Copy link
Copy Markdown
Member

This updates the security policy to clarify that crashes caused by application callbacks throwing uncaught exceptions are outside the Node.js threat model.

It also points to CVE-2026-21637 as an example of a case that was previously triaged as a vulnerability but should not be treated as one going forward.

Fixes: nodejs/security-wg#1568

Signed-off-by: Matteo Collina <hello@matteocollina.com>
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/tsc

@nodejs-github-bot nodejs-github-bot added the doc Issues and PRs related to the documentations. label Jun 16, 2026
@mcollina mcollina requested review from RafaelGSS and aduh95 June 16, 2026 10:07
@aduh95 aduh95 added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. commit-queue Add this label to land a pull request using GitHub Actions. labels Jun 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

author ready PRs that have at least one approval, no pending requests for changes, and a CI started. commit-queue Add this label to land a pull request using GitHub Actions. doc Issues and PRs related to the documentations.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Let's nullify CVE-2026-21637

8 participants