From 46554578233cbc27012e2a7fb50779336fd05f38 Mon Sep 17 00:00:00 2001 From: James M Snell Date: Thu, 20 Aug 2026 09:25:00 -0700 Subject: [PATCH 1/2] meta: refine the security vuln posture for experimental flagged features Currently, any runtime gated experimental feature security vulnerability is considered a "valid" vulnerability, even if the work is still very much work in progress. This adds friction because it ends up requiring that things be compile time gated which makes it more difficult if there is not a corresponding CI job to run tests. This relaxes the policy a bit. For anything that is 1.0 and 1.1, a vuln report is only valid if it directly compromises a stable feature, allows a workaround that compromises a stable feature, etc. An example would be an obvious DOS vector that can be exploited even if the feature is not enabled, for instance. This gives us leeway to reject vuln reports on things that are enabled only by `--experimental-*` runtime flag that are still works in progress. Signed-off-by: James M Snell --- SECURITY.md | 43 ++++++++++++++++++++++++++++++++----------- 1 file changed, 32 insertions(+), 11 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index b4239f5fda4e..900e2f81723b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -124,12 +124,12 @@ This policy recognizes that experimental platforms may not compile, may not pass the test suite, and do not have the same level of testing and support infrastructure as Tier 1 and Tier 2 platforms. -### Experimental features behind compile-time flags and V8 flags +### Experimental features behind compile-time flags, experimental runtime flags, and V8 flags Node.js includes certain experimental features that are only available when -Node.js is compiled with specific flags. These features are intended for -development, debugging, or testing purposes and are not enabled in official -releases. +Node.js is compiled with specific flags or that are only enabled with experimental +runtime flags. These features are intended for development, debugging, or testing +purposes and are not enabled or supported in official releases. Node.js may also expose V8 features that are controlled by V8 command-line flags (e.g., `--js-staging`, `--max_old_space_size`). These flags @@ -137,8 +137,35 @@ enable or modify V8-level JavaScript engine behavior that is not part of the ECMAScript specification that Node.js implements and is not part of the Node.js documented API surface. +#### Runtime gated experimental features + +Experimental features behind runtime flags can fall into one of three categories: + +* 1.0 - Early development. Experimental features at this stage are unfinished + and subject to substantial change. +* 1.1 - Active development. Experimental features at this stage are nearing + minimum viability. +* 1.2 - Release candidate. Experimental features at this stage are hopefully + ready to become stable. No further breaking changes are anticipated but may + still occur in response to user feedback or the features' underlying + specification development. We encourage user testing and feedback so that + we can know that this feature is ready to be marked as stable. + +Security vulnerabilities that only affect experimental features in either the +1.0 or 1.1 stages, and that are gated with an `--experimental-*` runtime flag +requiring explicit opt-in by the user to enable, will **not** be accepted as +valid security issues unless the vulnerability can be exploited in a way that +impacts the security of a stable feature when the associated `--experimental*` +flag is **not enabled**. + +Security vulnerabilities that affect experimental features in the 1.2 stage are +acceptable as valid security issues. + +#### Compile-time gated experimental features and V8 flags + * Security vulnerabilities that only affect features behind compile-time flags - or V8 flags will **not** be accepted as valid security issues. + or V8 flags _that are not enabled by default_ will **not** be accepted as valid + security issues. * Any issues with these features will be treated as normal bugs. * No CVEs will be issued for issues that only affect compile-time flag or V8 flag features. * Bug bounty rewards are not available for compile-time flag or V8 flag feature issues. @@ -505,12 +532,6 @@ vulnerability. Node.js validates the structure of Early Hints per the HTTP spec but does not sanitize free-form application data passed to it; that is the application's responsibility. -## Assessing experimental features reports - -Experimental features are eligible for security reports just like any other -stable feature of Node.js. They may also receive the same severity score that a -stable feature would. - ## Receiving security updates Security notifications will be distributed via the following methods. From 15f3ea3db88352ce16b966525cb039d70cc51764 Mon Sep 17 00:00:00 2001 From: James M Snell Date: Fri, 21 Aug 2026 08:56:12 -0700 Subject: [PATCH 2/2] meta: exclude QUIC/H3 specifically from vuln coverage for now Given it's complexity and active development, give ourselves coverage by specifically excluding QUIC/H3 from vuln reports. Any vuln reports received for QUIC, unless it's something that can compromise security of something else in Node.js when the `--experimental-quic` runtime flag is not enabled, should be handled as regular issues and not as security vulns Signed-off-by: James M Snell --- SECURITY.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 900e2f81723b..fa0f81d0596c 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -496,6 +496,15 @@ The following are **not** vulnerabilities in Node.js: restrictions of their parent process. Passing an empty or modified `execArgv` to a worker does not grant it additional permissions. +#### QUIC and HTTP/3 + +The experimental QUIC and HTTP/3 implementation in Node.js is a complex new +protocol stack and API that is still under active development and should not be +used for production workloads. Reports that only affect QUIC or HTTP/3 are not +considered Node.js vulnerabilities at this time. It is expected that the QUIC +and HTTP/3 implementation will continue to evolve, and security issues will be +addressed as the implementation matures. + #### Virtual File System (`node:vfs`) The experimental [Virtual File System](https://nodejs.org/api/vfs.html)