Title: Buffer#indexOf()/lastIndexOf()/includes() abort the process when end is not a number · Issue #66589 · nodejs/node · GitHub
Open Graph Title: Buffer#indexOf()/lastIndexOf()/includes() abort the process when end is not a number · Issue #66589 · nodejs/node
X Title: Buffer#indexOf()/lastIndexOf()/includes() abort the process when end is not a number · Issue #66589 · nodejs/node
Description: Version v27.0.0-nightly20261007aa1bf2cc37 (main at 9899b39) Platform Linux x64 Subsystem buffer What steps will reproduce the bug? const buf = Buffer.from('abcabc'); // Each of these aborts the process, try/catch does not help: buf.index...
Open Graph Description: Version v27.0.0-nightly20261007aa1bf2cc37 (main at 9899b39) Platform Linux x64 Subsystem buffer What steps will reproduce the bug? const buf = Buffer.from('abcabc'); // Each of these aborts the pro...
X Description: Version v27.0.0-nightly20261007aa1bf2cc37 (main at 9899b39) Platform Linux x64 Subsystem buffer What steps will reproduce the bug? const buf = Buffer.from('abcabc'); // Each of these aborts...
Opengraph URL: https://github.com/nodejs/node/issues/66589
X: @github
Domain: github.com
{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Buffer#indexOf()/lastIndexOf()/includes() abort the process when end is not a number","articleBody":"### Version\n\nv27.0.0-nightly20261007aa1bf2cc37 (main at 9899b39b95)\n\n### Platform\n\nLinux x64\n\n### Subsystem\n\nbuffer\n\n### What steps will reproduce the bug?\n\n```js\nconst buf = Buffer.from('abcabc');\n\n// Each of these aborts the process, try/catch does not help:\nbuf.indexOf('a', 0, null);\nbuf.includes(97, 0, null);\nbuf.lastIndexOf(Buffer.from('a'), 5, {});\n\n// These return -1, expected 0:\nbuf.indexOf('a', 0, Infinity);\nbuf.indexOf(97, 0, 1e20);\n```\n\n### How often does it reproduce? Is there a required condition?\n\nAlways. Any `end` other than a number, a string or `undefined` aborts (`null`, booleans, objects, arrays, BigInts, symbols). Numbers outside the int64 range give a wrong result on x64.\n\n### What is the expected behavior? Why is that the expected behavior?\n\n`end` is documented as `{integer}`, so a wrong type should throw `ERR_INVALID_ARG_TYPE` instead of aborting. `Infinity` should be clamped to `buf.length`, the same way `end = 100` already is.\n\n### What do you see instead?\n\n```\n # node[788155]: void node::Buffer::(anonymous namespace)::IndexOfString(const FunctionCallbackInfo\u003cValue> &) at ../src/node_buffer.cc:1036\n # Assertion failed: args[5]->IsNumber()\n```\n\nand `-1` for the `Infinity` / `1e20` cases.\n\n### Additional information\n\nThe three methods only handle `end` in JS when it is a string (treated as the encoding) or `undefined`; anything else goes straight to the binding. `IndexOfString` and `IndexOfBuffer` do `CHECK(args[5]->IsNumber())` and `SlowIndexOfNumber` does `CHECK(args[4]->IsNumber())`. Numbers are read with `As\u003cInteger>()->Value()`, which for NaN, ±Infinity or values beyond int64 is an undefined double-to-int64 conversion (`INT64_MIN` on x64, which is then clamped to 0).\n\n`end` was added in #62390. I have a fix and will open a PR.\n","author":{"url":"https://github.com/gengjiawen","@type":"Person","name":"gengjiawen"},"datePublished":"2026-10-08T06:33:06Z","url":"https://github.com/nodejs/node/issues/66589"}
| react-profiling | 0 |
| react-import-map | react,react-dom,react-dom/client,react-dom/profiling,react-is,react-reconciler,react/compiler-runtime,react/jsx-dev-runtime,react/jsx-runtime,scheduler@d5750093facf |
| route-pattern | /_view_fragments/issues/show/:user_id/:repository/:id/issue_layout(.:format) |
| route-controller | voltron_issues_fragments |
| route-action | issue_layout |
| fetch-nonce | v2:b20efb95-2ac2-31d2-2254-8b832249862c |
| current-catalog-service-hash | 81bb79d38c15960b92d99bca9288a9108c7a47b18f2423d0f6438c5b7bcd2114 |
| request-id | A3B4:39A2F9:93FB8B:C55C54:6AED2EE1 |
| html-safe-nonce | b0dbc4dcd042920149217a7ae1759c4717b07cf68f9b95375cde6dd720d11cb4 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJBM0I0OjM5QTJGOTo5M0ZCOEI6QzU1QzU0OjZBRUQyRUUxIiwidmlzaXRvcl9pZCI6IjY4MzYyMTk4MzUzMjMzMzAyNzMiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ== |
| visitor-hmac | 96b522ff22e0756be3a343b15ec4eb0100c92186f0c1e66dcc8a00c220f78842 |
| hovercard-subject-tag | issue:5757109302 |
| github-keyboard-shortcuts | repository,issues,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/_view_fragments/issues/show/nodejs/node/66589/issue_layout |
| twitter:image | https://opengraph.githubassets.com/56111af50fad57ada8e363c0b309088b9bbc0e28552c549798de8b52560d6b94/nodejs/node/issues/66589 |
| twitter:card | summary_large_image |
| og:image | https://opengraph.githubassets.com/56111af50fad57ada8e363c0b309088b9bbc0e28552c549798de8b52560d6b94/nodejs/node/issues/66589 |
| og:image:alt | Version v27.0.0-nightly20261007aa1bf2cc37 (main at 9899b39) Platform Linux x64 Subsystem buffer What steps will reproduce the bug? const buf = Buffer.from('abcabc'); // Each of these aborts the pro... |
| og:image:width | 1200 |
| og:image:height | 600 |
| og:site_name | GitHub |
| og:type | object |
| og:author:username | gengjiawen |
| hostname | github.com |
| expected-hostname | github.com |
| None | e51d0b7b5ab34b1688c05b54c3ed17b8658b2fa9bca973a9c740683ccb12cf4a |
| turbo-cache-control | no-preview |
| go-import | github.com/nodejs/node git https://github.com/nodejs/node.git |
| octolytics-dimension-user_id | 9950313 |
| octolytics-dimension-user_login | nodejs |
| octolytics-dimension-repository_id | 27193779 |
| octolytics-dimension-repository_nwo | nodejs/node |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 27193779 |
| octolytics-dimension-repository_network_root_nwo | nodejs/node |
| turbo-body-classes | logged-out env-production page-responsive |
| disable-turbo | false |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 59ebb7b901cc154ecc179a44f266fcf69f343b30 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
| react-app-name | issues |
Links:
Viewport: width=device-width