[woolfi182]

The stateless reset tokens that a QUIC session generates for its own connection IDs (Session::GenerateNewConnectionId() for NEW_CONNECTION_ID frames, and TransportParams::GeneratePreferredAddressToken()) were registered in SessionManager::token_map_. That map is what Endpoint::Receive() consults to recognize a stateless reset sent by the peer; per the comments in endpoint.cc and session_manager.h, it should only contain tokens previously given by the remote peer, and sessions clean up their entries on teardown.

Teardown (Session::Impl::~Impl()) only removes the peer's tokens (ngtcp2_conn_get_active_dcid2()), so the locally issued entries were never removed and kept a raw Session* after the session was destroyed. A short header packet for an unknown connection ID ending in one of those tokens was then:

• dispatched to the destroyed session and silently dropped, instead of being answered with a stateless reset, and
• once the Session had been garbage collected, a use-after-free in maybeStatelessReset().

This change stops registering locally issued tokens. They are still generated and sent to the peer; nothing on the receive side needs them, since the peer's tokens are registered through the dcid_status callback.

The new test reads the server's NEW_CONNECTION_ID tokens from its qlog, destroys the session, and sends the server endpoint a short header packet that ends in one of those tokens, followed by a control packet. Each reply is matched to its packet by the reset token derived from the packet's destination connection ID. Without the fix, the server answers only the control packet, and the process often crashes with SIGSEGV (an ASAN build reports a heap-use-after-free in Session::is_destroyed()); with it, both packets get a stateless reset.

QUIC is at Stability 1.0 behind --experimental-quic, so per SECURITY.md this is handled as a regular bug.

AI disclosure: this change was developed with assistance from Claude Code (analysis, fix and test). I reviewed the change and verified locally that the new test fails without the fix and passes with it, and that parallel/test-quic-* and the QUIC cctests pass.

[nodejs-github-bot]

Review requested:

• @nodejs/quic

[github-actions]

Welcome to Node.js, and thank you for your first contribution!

Before review, please take a moment to read:

• the guide for first-time contributors
• the contribution and automation policies
• the pull request guide
• the AI use policy
• the Code of Conduct

Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.58%. Comparing base (9b5d938) to head (89c5ac9).
⚠️ Report is 30 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #67000      +/-   ##
==========================================
- Coverage   90.59%   90.58%   -0.01%     
==========================================
  Files         797      797              
  Lines      278367   278376       +9     
  Branches    53531    53538       +7     
==========================================
- Hits       252174   252156      -18     
- Misses      16565    16589      +24     
- Partials     9628     9631       +3     

see 33 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pimterry]

LGTM, nice find! 👍

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/78662/

[pimterry]

The new test is failing in no-OpenSSL builds:

duration_ms: 125.023
exitcode: 1
severity: fail
stack: |-
  node:internal/util:242
      throw new ERR_NO_CRYPTO();
      ^

  Error [ERR_NO_CRYPTO]: Node.js is not compiled with OpenSSL crypto support
      at assertCrypto (node:internal/util:242:11)
      at node:crypto:36:1
      at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:440:7)
      at BuiltinModule.compileForPublicLoader (node:internal/bootstrap/realm:379:10)
      at loadBuiltinModule (node:internal/modules/helpers:269:7)
      at ModuleLoader.builtinStrategy (node:internal/modules/esm/translators:479:18)
      at #translate (node:internal/modules/esm/loader:480:20)
      at afterLoad (node:internal/modules/esm/loader:548:29)
      at ModuleLoader.loadAndTranslate (node:internal/modules/esm/loader:553:12)
      at #getOrCreateModuleJobAfterResolve (node:internal/modules/esm/loader:606:36) {
    code: 'ERR_NO_CRYPTO'
  }

If you check how the other tests work, you'll see how you can update this so it's automatically skipped in that environment.