René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"quic: SIGSEGV on exit after a client writes to a unidirectional stream on an h3 session","articleBody":"### Version\n\nmain\n\n### Platform\n\n```text\nN/A\n```\n\n### Subsystem\n\nquic\n\n### What steps will reproduce the bug?\n\n```js\nimport { readFileSync } from 'node:fs';\nimport { createPrivateKey } from 'node:crypto';\nimport { listen, connect } from 'node:quic';\n\n// in the repo, the keys are in test/fixtures/keys\nconst key = createPrivateKey(readFileSync('/path/to/key.pem'));\nconst cert = readFileSync('/path/to/cert.pem');\n\n// ALPN defaults to 'h3'.\nconst endpoint = await listen(() => {}, { sni: { '*': { keys: [key], certs: [cert] } } });\nconst session = await connect(endpoint.address, { servername: 'localhost', verifyPeer: 'manual' });\n\nconst stream = await session.createUnidirectionalStream();\nstream.writer.writeSync('x');\n\nawait endpoint.destroy();\nconsole.log('reached end of script');\n```\n\n### How often does it reproduce? Is there a required condition?\n\nAlways\n\n### What is the expected behavior? Why is that the expected behavior?\n\nexit code 0 with no crash.\n\nThe client opens a plain unidirectional stream on an HTTP/3 connection, which is not a valid h3 stream, so the server should treat it as a protocol error or discard it, and either way tear down cleanly.\n\n### What do you see instead?\n\n```console\nreached end of script\nzsh: segmentation fault (core dumped)  ../node/node --experimental-quic --no-warnings repro.js\n```\n\nThe script runs to completion and prints reached end of script, then the process dies with SIGSEGV instead of exiting 0. The crash is therefore after endpoint.destroy() has resolved, during process teardown, not inside any QUIC call the script awaits. Nothing is reported on the JS side: no error, no rejection, no warning.\n\n### Additional information\n\nObservations:\n* ALPN must be h3. With a custom ALPN (`alpn: ['test-proto']`) the same script exits cleanly, and the stream is delivered to `onstream` as expected.\n* The write is required. Dropping `stream.writer.writeSync('x')` makes it exit cleanly.\n* `onstream` is irrelevant: it crashes whether or not the server registers one. That distinguishes it from #64030, which required no `onstream` and a non-h3 ALPN, and was fixed in July.\n* Teardown is what surfaces it. `endpoint.destroy()` alone is enough, and `close()` on both sides also crashes. With no teardown the process just hangs on open handles.\n* On h3 the stream never reaches JavaScript, since nghttp3 consumes non-request streams internally, so no JS-visible stream object is involved.","author":{"url":"https://github.com/trivikr","@type":"Person","name":"trivikr"},"datePublished":"2026-08-19T23:17:15Z","url":"https://github.com/nodejs/node/issues/65408"}