René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"node:vfs MemoryProvider: readdirSync({recursive:true}) crashes via circular symlinks (stack overflow)","articleBody":"## node:vfs MemoryProvider: readdirSync({recursive:true}) stack overflow via circular symlinks\n\n**Affected:** `node:vfs` MemoryProvider (experimental)  \n**Node version:** v27.0.0-nightly20260625c5635b82c9  \n**Flag required:** `--experimental-vfs`\n\n### Summary\n\n`MemoryProvider#readdirSync` with `recursive: true` crashes the Node.js process with a stack overflow (`RangeError: Maximum call stack size exceeded`) when the virtual filesystem contains circular symlinks. Both sync and async variants are affected. The process exits with code 1 when the error is uncaught.\n\n### Root Cause\n\nThe internal `walk()` function inside `#readdirRecursive` (memory.js ~line 643) follows symlinks to directories recursively but does **not** track visited paths or entries. This completely bypasses the `kMaxSymlinkDepth = 40` guard that exists in `#lookupEntry`, causing unbounded recursion until the call stack is exhausted.\n\n```js\n// walk() calls itself with no cycle detection:\nif (resolvedChild.isDirectory()) {\n  const childPath = pathPosix.join(currentPath, name);\n  walk(resolvedChild, childPath, childRelative); // infinite if circular symlink\n}\n```\n\n### PoC 1 — Self-referential symlink\n\n```js\nconst vfs = require('node:vfs');\nconst mem = new vfs.MemoryProvider();\nconst sandbox = vfs.create(mem);\n\nsandbox.mkdirSync('/dir');\nsandbox.symlinkSync('/dir', '/dir/loop'); // /dir/loop -\u003e /dir\n\n// Crashes: RangeError: Maximum call stack size exceeded\nsandbox.readdirSync('/', { recursive: true });\n```\n\n### PoC 2 — Mutual circular chain (a -\u003e b -\u003e a)\n\n```js\nconst vfs = require('node:vfs');\nconst mem = new vfs.MemoryProvider();\nconst sandbox = vfs.create(mem);\n\nsandbox.mkdirSync('/a');\nsandbox.mkdirSync('/b');\nsandbox.symlinkSync('/a', '/b/link_to_a');\nsandbox.symlinkSync('/b', '/a/link_to_b');\n\n// Also crashes\nsandbox.readdirSync('/', { recursive: true });\n```\n\n### PoC 3 — Async variant also affected\n\n```js\nconst vfs = require('node:vfs');\nconst mem = new vfs.MemoryProvider();\nconst sandbox = vfs.create(mem);\n\nsandbox.mkdirSync('/dir');\nsandbox.symlinkSync('/dir', '/dir/loop');\n\n// Also crashes\nsandbox.promises.readdir('/', { recursive: true })\n  .catch(e =\u003e console.log(e.message)); // Maximum call stack size exceeded\n```\n\n### Stack trace (uncaught)\nnode:path:1332\n\njoin(...args) {\n\n^\n\nRangeError: Maximum call stack size exceeded\n\nat Object.join (node:path:1332:7)\n\nat #lookupEntry (node:internal/vfs/providers/memory:315:31)\n\nat walk (node:internal/vfs/providers/memory:643:43)\n\nat walk (node:internal/vfs/providers/memory:650:11)\n\nat walk (node:internal/vfs/providers/memory:650:11)\n\nat walk (node:internal/vfs/providers/memory:650:11)\n\n### Suggested Fix\n\nTrack visited entries inside `walk()` to detect cycles:\n\n```js\nconst visited = new Set();\nconst walk = (entry, currentPath, relativePath) =\u003e {\n  if (visited.has(entry)) return; // break cycle\n  visited.add(entry);\n  // ... rest of existing walk logic\n};\n```\n\n### Impact\n\nAny application calling `readdirSync` or `promises.readdir` with `recursive: true` on a `MemoryProvider` that contains circular symlinks will crash the Node.js process. In server-side contexts where the VFS is user-influenced, this enables a **Denial of Service**. The existing `kMaxSymlinkDepth` guard does not protect against this code path.\n\nNote: `symlinkSync` in `MemoryProvider` does not validate circular targets, making this easy to trigger.\n\n\u003cimg width=\"1122\" height=\"1032\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/545ab293-efe1-4a9c-8c34-f7cdd041a8a3\" /\u003e\n\n\u003cimg width=\"1007\" height=\"327\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/ddfb993b-5d78-4223-881c-08524f75057d\" /\u003e\n","author":{"url":"https://github.com/jojin1709","@type":"Person","name":"jojin1709"},"datePublished":"2026-06-26T11:06:44.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/64148/node/issues/64148"}