[araujogui]

SocketAddress.parse() built a http://${input} URL and read the host back out. The WHATWG parser is lenient, so it accepted input that is not a socket address. Legacy IPv4 like 0177.0.0.1, 0x7f.0.0.1, 2130706433 and 127.1, URL syntax like user@1.2.3.4:80, and rewritten input such as tabs and IDNA digits all passed. It also disagreed with the constructor, which rejects them.

Now it splits host and port in C++ and validates with uv_inet_pton(), same as the constructor.

Those legacy forms are the differential behind CVE-2021-29923, CVE-2021-29922 and the TLS CVEs this cycle, CVE-2026-106069 and CVE-2026-106072, where the parser and the resolver read them differently. parse() isn't a security boundary, so this is hardening rather than a CVE fix.

Also fixes #62906. parse('1.2.3.4:80') returned port 0 because the URL parser drops a scheme's default port. It now returns 80.

Grammar is documented in doc/api/net.md. IPv6 zone ids are left out, since sin6_scope_id isn't on the JS object and a scoped address can't round-trip its own JSON.

[nodejs-github-bot]

Review requested:

• @nodejs/net

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Renegade334]

This would make the port issue much simpler with this additional validation. If the string ends in /:(\d+)$/, then it can just be sliced off, and if the rest of the string gets parsed as a valid hostname by URLParse then the port can be obtained from the digit string with NumberParseInt.

[codecov]

Codecov Report

❌ Patch coverage is 94.68085% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.66%. Comparing base (03cca65) to head (7d1b20d).
⚠️ Report is 81 commits behind head on main.

Files with missing lines	Patch %	Lines
src/node_sockaddr.cc	76.47%	0 Missing and 4 partials ⚠️
src/node_sockaddr_parser.cc	98.63%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #64832      +/-   ##
==========================================
+ Coverage   90.58%   90.66%   +0.08%     
==========================================
  Files         797      798       +1     
  Lines      278297   278869     +572     
  Branches    53515    53645     +130     
==========================================
+ Hits       252096   252846     +750     
+ Misses      16561    16360     -201     
- Partials     9640     9663      +23     

Files with missing lines	Coverage Δ
lib/internal/socketaddress.js	98.88% <100.00%> (-0.11%)	⬇️
src/node_sockaddr.h	51.28% <ø> (ø)
src/node_sockaddr_parser.cc	98.63% <98.63%> (ø)
src/node_sockaddr.cc	75.35% <76.47%> (+0.02%)	⬆️

... and 77 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Renegade334]

LGTM!

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/75615/

[araujogui]

@Renegade334 maybe we should include semver-major tag?

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/75974/

[jasnell]

I'm not yet convinced this is the best way to approach this (with the regex). Won't block for now but there's probably a more performant / reliable way.

[araujogui]

I'm not yet convinced this is the best way to approach this (with the regex). Won't block for now but there's probably a more performant / reliable way.

@jasnell I implemented a new strict socket address parser replacing Ada, it fixes #62906 and is faster. Benchmark results compared to main:

                                                           confidence improvement accuracy (*)   (**)  (***)
net/net-socketaddress-parse.js input='ipv4-port' n=1000000        ***     52.37 %       ±0.63% ±0.84% ±1.10%
net/net-socketaddress-parse.js input='ipv4' n=1000000             ***     43.38 %       ±0.64% ±0.86% ±1.12%
net/net-socketaddress-parse.js input='ipv6-port' n=1000000        ***     59.56 %       ±0.49% ±0.65% ±0.85%
net/net-socketaddress-parse.js input='ipv6' n=1000000             ***     47.35 %       ±0.50% ±0.66% ±0.86%

Be aware that when doing many comparisons the risk of a false-positive result increases.
In this case, there are 4 comparisons, you can thus expect the following amount of false-positive results:
  0.20 false positives, when considering a   5% risk acceptance (*, **, ***),
  0.04 false positives, when considering a   1% risk acceptance (**, ***),
  0.00 false positives, when considering a 0.1% risk acceptance (***)

[github-actions]

Benchmark GHA (net / net-socketaddress-parse): https://github.com/nodejs/node/actions/runs/33605572788

Results

[!WARNING]
Do not take GHA benchmark results as face value, always confirm them
using a dedicated machine, e.g. Jenkins CI.

Benchmark results:

                                                           confidence improvement accuracy (*)    (**)   (***)
net/net-socketaddress-parse.js input='ipv4-port' n=1000000        ***     29.96 %      ±10.23% ±13.49% ±17.31%
net/net-socketaddress-parse.js input='ipv4' n=1000000             ***     34.36 %      ±10.45% ±13.78% ±17.68%
net/net-socketaddress-parse.js input='ipv6-port' n=1000000        ***     28.40 %      ±10.07% ±13.27% ±17.03%
net/net-socketaddress-parse.js input='ipv6' n=1000000             ***     31.02 %      ±10.04% ±13.24% ±16.99%

Be aware that when doing many comparisons the risk of a false-positive
result increases. In this case, there are 4 comparisons, you can thus
expect the following amount of false-positive results:
  0.20 false positives, when considering a   5% risk acceptance (*, **, ***),
  0.04 false positives, when considering a   1% risk acceptance (**, ***),
  0.00 false positives, when considering a 0.1% risk acceptance (***)

[!WARNING]
Do not take GHA benchmark results as face value, always confirm them
using a dedicated machine, e.g. Jenkins CI.