René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Passing malformed UNC hostname to pathToFileURL() crashes the process","articleBody":"### Version\n\nv25.9.0\n\n### Platform\n\n```text\nLinux snoopy-MacBookPro11-4 6.17.0-19-generic #19~24.04.2-Ubuntu SMP PREEMPT_DYNAMIC Fri Mar  6 23:08:46 UTC 2 x86_64 x86_64 x86_64 GNU/Linux\n```\n\n### Subsystem\n\n_No response_\n\n### What steps will reproduce the bug?\n\n`node -e \"const p='\\\\\\\\\\\\\\\\exa mple\\\\\\\\share\\\\\\\\file.txt'; console.log(JSON.stringify(p)); require('node:url').pathToFileURL(p,{windows:true});\"`\n\n```\nsnoopy@snoopy-MacBookPro11-4:~/$ node -e \"require('node:url').pathToFileURL('\\\\\\\\\\\\\\\\exa mple\\\\\\\\share\\\\\\\\file.txt',{windows:true})\"; echo $?\n\n  #  node[95573]: static void node::url::BindingData::PathToFileURL(const FunctionCallbackInfo\u003cValue\u003e \u0026) at ../src/node_url.cc:172\n  #  Assertion failed: out-\u003eset_hostname(hostname.ToStringView())\n\n----- Native stack trace -----\n\n 1: 0x90ace8 node::Assert(node::AssertionInfo const\u0026) [node]\n 2: 0xa2a2b7 node::url::BindingData::PathToFileURL(v8::FunctionCallbackInfo\u003cv8::Value\u003e const\u0026) [node]\n 3: 0x771269d8fb4d \n\n----- JavaScript stack trace -----\n\n1: URL (node:internal/url:825:20)\n2: pathToFileURL (node:internal/url:1659:12)\n3: pathToFileURL (node:url:1022:10)\n4: [eval]:1:21\n5: runScriptInThisContext (node:internal/vm:219:10)\n6: node:internal/process/execution:483:12\n7: [eval]-wrapper:6:24\n8: runScriptInContext (node:internal/process/execution:481:60)\n9: evalFunction (node:internal/process/execution:315:30)\n10: evalTypeScript (node:internal/process/execution:327:3)\n\n\nAborted (core dumped)\n134\nsnoopy@snoopy-MacBookPro11-4:~/ node -v\nv25.9.0\nsnoopy@snoopy-MacBookPro11-4:~/$ \n```\n\n### How often does it reproduce? Is there a required condition?\n\nNo require condition\n\n### What is the expected behavior? Why is that the expected behavior?\n\nprocess shouldn't crash\n\n### What do you see instead?\n\nprocess crash\n\n### Additional information\n\nThis could be considered denial of service, but reading https://github.com/nodejs/node/blob/main/SECURITY.md, hence opening a github issue. reading https://github.com/nodejs/node/blob/main/SECURITY.md probably a bug than a security issue\n\nedit: confirmed with nodejs-wg team that they see it as a bug, reopening to keep track","author":{"url":"https://github.com/snoopysecurity","@type":"Person","name":"snoopysecurity"},"datePublished":"2026-04-01T23:19:34.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/62546/node/issues/62546"}