Skip to content

meta: refine the security vuln posture for experimental flagged features #65438

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jasnell wants to merge 2 commits into
base: main
Choose a base branch
from
+41 −11
Open

meta: refine the security vuln posture for experimental flagged features #65438

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4655457
meta: refine the security vuln posture for experimental flagged features
jasnell Aug 20, 2026
15f3ea3
meta: exclude QUIC/H3 specifically from vuln coverage for now
jasnell Aug 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 41 additions & 11 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,21 +124,48 @@ This policy recognizes that experimental platforms may not compile, may not
pass the test suite, and do not have the same level of testing and support
infrastructure as Tier 1 and Tier 2 platforms.

### Experimental features behind compile-time flags and V8 flags
### Experimental features behind compile-time flags, experimental runtime flags, and V8 flags

Node.js includes certain experimental features that are only available when
Node.js is compiled with specific flags. These features are intended for
development, debugging, or testing purposes and are not enabled in official
releases.
Node.js is compiled with specific flags or that are only enabled with experimental
runtime flags. These features are intended for development, debugging, or testing
purposes and are not enabled or supported in official releases.

Node.js may also expose V8 features that are controlled by V8 command-line flags
(e.g., `--js-staging`, `--max_old_space_size`). These flags
enable or modify V8-level JavaScript engine behavior that is not part of the
ECMAScript specification that Node.js implements and is not part of the
Node.js documented API surface.

#### Runtime gated experimental features

Experimental features behind runtime flags can fall into one of three categories:

* 1.0 - Early development. Experimental features at this stage are unfinished

@legendecas legendecas Aug 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is a bit verbose similar to https://github.com/nodejs/node/blob/main/doc/api/documentation.md?plain=1#L38. Can we just link to https://github.com/nodejs/node/blob/main/doc/api/documentation.md#stability-index?

and subject to substantial change.
* 1.1 - Active development. Experimental features at this stage are nearing
minimum viability.
* 1.2 - Release candidate. Experimental features at this stage are hopefully
ready to become stable. No further breaking changes are anticipated but may
still occur in response to user feedback or the features' underlying
specification development. We encourage user testing and feedback so that
we can know that this feature is ready to be marked as stable.

Security vulnerabilities that only affect experimental features in either the
1.0 or 1.1 stages, and that are gated with an `--experimental-*` runtime flag
requiring explicit opt-in by the user to enable, will **not** be accepted as
valid security issues unless the vulnerability can be exploited in a way that
impacts the security of a stable feature when the associated `--experimental*`
flag is **not enabled**.

Security vulnerabilities that affect experimental features in the 1.2 stage are
acceptable as valid security issues.

#### Compile-time gated experimental features and V8 flags

* Security vulnerabilities that only affect features behind compile-time flags
or V8 flags will **not** be accepted as valid security issues.
or V8 flags _that are not enabled by default_ will **not** be accepted as valid
security issues.
* Any issues with these features will be treated as normal bugs.
* No CVEs will be issued for issues that only affect compile-time flag or V8 flag features.
* Bug bounty rewards are not available for compile-time flag or V8 flag feature issues.
Expand Down Expand Up @@ -469,6 +496,15 @@ The following are **not** vulnerabilities in Node.js:
restrictions of their parent process. Passing an empty or modified `execArgv`
to a worker does not grant it additional permissions.

#### QUIC and HTTP/3

The experimental QUIC and HTTP/3 implementation in Node.js is a complex new
protocol stack and API that is still under active development and should not be
used for production workloads. Reports that only affect QUIC or HTTP/3 are not
considered Node.js vulnerabilities at this time. It is expected that the QUIC
and HTTP/3 implementation will continue to evolve, and security issues will be
addressed as the implementation matures.

#### Virtual File System (`node:vfs`)

The experimental [Virtual File System](https://nodejs.org/api/vfs.html)
Expand Down Expand Up @@ -505,12 +541,6 @@ vulnerability. Node.js validates the structure of Early Hints per the HTTP spec
but does not sanitize free-form application data passed to it; that is the
application's responsibility.

## Assessing experimental features reports

Experimental features are eligible for security reports just like any other
stable feature of Node.js. They may also receive the same severity score that a
stable feature would.

## Receiving security updates

Security notifications will be distributed via the following methods.
Expand Down
Loading