Title: zlib: Zstd decompression silently accepts truncated input · Issue #64592 · nodejs/node · GitHub
Open Graph Title: zlib: Zstd decompression silently accepts truncated input · Issue #64592 · nodejs/node
X Title: zlib: Zstd decompression silently accepts truncated input · Issue #64592 · nodejs/node
Description: Version latest main branch Platform 7.1.3-arch1-3 Subsystem zlib What steps will reproduce the bug? const assert = require('node:assert'); const zlib = require('node:zlib'); const compressed = zlib.zstdCompressSync('hello world'); const ...
Open Graph Description: Version latest main branch Platform 7.1.3-arch1-3 Subsystem zlib What steps will reproduce the bug? const assert = require('node:assert'); const zlib = require('node:zlib'); const compressed = zlib...
X Description: Version latest main branch Platform 7.1.3-arch1-3 Subsystem zlib What steps will reproduce the bug? const assert = require('node:assert'); const zlib = require('node:zlib'); const c...
Opengraph URL: https://github.com/nodejs/node/issues/64592
X: @github
Domain: github.com
{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"zlib: Zstd decompression silently accepts truncated input","articleBody":"### Version\n\nlatest main branch\n\n### Platform\n\n```text\n7.1.3-arch1-3\n```\n\n### Subsystem\n\nzlib\n\n### What steps will reproduce the bug?\n\n```js\n const assert = require('node:assert');\n const zlib = require('node:zlib');\n\n const compressed = zlib.zstdCompressSync('hello world');\n const truncated = compressed.subarray(0, compressed.length / 2);\n\n const actual = zlib.zstdDecompressSync(truncated);\n console.log(actual.toString()); // \"h\"\n```\n\n\n\n### How often does it reproduce? Is there a required condition?\n\nEvery time\n\n### What is the expected behavior? Why is that the expected behavior?\n\nWith the default finishFlush: ZSTD_e_end, both APIs should report an unexpected end of file error when the Zstd frame is incomplete.While other decompress api in zlib module would throw \"unexpeted of EOF\" for imcomplete input so I just assume this is a kind of implementation problem.\n\n### What do you see instead?\n\n`zstdDecompress()` and `zstdDecompressSync()` currently succeed when the input ends before a complete Zstd frame has been received.\n\n### Additional information\n\n_No response_","author":{"url":"https://github.com/Archkon","@type":"Person","name":"Archkon"},"datePublished":"2026-07-19T04:39:28.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/64592/node/issues/64592"}
| route-pattern | /_view_fragments/issues/show/:user_id/:repository/:id/issue_layout(.:format) |
| route-controller | voltron_issues_fragments |
| route-action | issue_layout |
| fetch-nonce | v2:cb3df045-a44d-6913-275b-ec5e7fa9ac95 |
| current-catalog-service-hash | 81bb79d38c15960b92d99bca9288a9108c7a47b18f2423d0f6438c5b7bcd2114 |
| request-id | 8E66:D2C58:22F38B4:23C6C10:6A62DFA6 |
| html-safe-nonce | 73a030fd737c1f0c4a4f33fa9c7eb670ab14f67ba4263548f6c8e96495771672 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI4RTY2OkQyQzU4OjIyRjM4QjQ6MjNDNkMxMDo2QTYyREZBNiIsInZpc2l0b3JfaWQiOiI4MjYxNTIwMzQ4OTkyOTU0Mjc4IiwicmVnaW9uX2VkZ2UiOiJzZWEiLCJyZWdpb25fcmVuZGVyIjoic2VhIn0= |
| visitor-hmac | ad18c8f55aecf3d54182f1d793911bc55af28e21d046d1aebeb25a4535bfa6e8 |
| hovercard-subject-tag | issue:4921328400 |
| github-keyboard-shortcuts | repository,issues,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/_view_fragments/issues/show/nodejs/node/64592/issue_layout |
| twitter:image | https://opengraph.githubassets.com/83a2731799529fced57b5397e9d227c9328804fe1148465896ad25e29f38e25a/nodejs/node/issues/64592 |
| twitter:card | summary_large_image |
| og:image | https://opengraph.githubassets.com/83a2731799529fced57b5397e9d227c9328804fe1148465896ad25e29f38e25a/nodejs/node/issues/64592 |
| og:image:alt | Version latest main branch Platform 7.1.3-arch1-3 Subsystem zlib What steps will reproduce the bug? const assert = require('node:assert'); const zlib = require('node:zlib'); const compressed = zlib... |
| og:image:width | 1200 |
| og:image:height | 600 |
| og:site_name | GitHub |
| og:type | object |
| og:author:username | Archkon |
| hostname | github.com |
| expected-hostname | github.com |
| None | df33b1b61ee7b9a0af988199bfc3503c9c1acafb1f1d40e1f140ea7c84f890dd |
| turbo-cache-control | no-preview |
| go-import | github.com/nodejs/node git https://github.com/nodejs/node.git |
| octolytics-dimension-user_id | 9950313 |
| octolytics-dimension-user_login | nodejs |
| octolytics-dimension-repository_id | 27193779 |
| octolytics-dimension-repository_nwo | nodejs/node |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 27193779 |
| octolytics-dimension-repository_network_root_nwo | nodejs/node |
| turbo-body-classes | logged-out env-production page-responsive |
| disable-turbo | false |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | d41cd1bdb290013455c0ac430fa755621733f5eb |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width