[nikolas-sapa]

When calling buf.indexOf(val, offset, encoding) (or lastIndexOf/includes) with a non-string and non-numeric value for encoding (such as null or {}), the end argument is not normalized to this.length because the current check only handles typeof end === 'string' or end === undefined:

Buffer.prototype.indexOf = function indexOf(val, offset, end, encoding) {
  if (typeof end === 'string') {
    encoding = end;
    end = this.length;
  } else if (end === undefined) {
    end = this.length;
  }
  return bidirectionalIndexOf(this, val, offset, end, encoding, 0);
};

When encoding is passed as null in a 3-argument call (e.g. buf.indexOf(1, 0, null) or buf.indexOf(Buffer.from('a'), 0, null)), end is passed as null to the C++ bindings. This triggers fatal CHECK assertion failures (CHECK(args[end_idx]->IsNumber()) in src/node_buffer.cc), aborting the process with SIGABRT (exit code 134):

# void node::Buffer::(anonymous namespace)::IndexOfString(const FunctionCallbackInfo<Value> &) at ../src/node_buffer.cc:1036
# Assertion failed: args[5]->IsNumber()

Changes

1. In Buffer.prototype.indexOf, lastIndexOf, and includes, normalize end to this.length when encoding === undefined && typeof end !== 'number'.
2. In bidirectionalIndexOf, defensively normalize non-numeric end to a number, defaulting NaN to buffer.length.
3. Added parallel regression tests in test/parallel/test-buffer-indexof-null-encoding.js covering numeric, buffer, and string targets with null, {}, and false encodings across indexOf, lastIndexOf, and includes.

[github-actions]

Welcome to Node.js, and thank you for your first contribution!

Before review, please take a moment to read:

• the guide for first-time contributors
• the contribution and automation policies
• the pull request guide
• the AI use policy
• the Code of Conduct

Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal.

Caution

AgentScan found account activity patterns that may be consistent with automation. This is a heuristic, not proof that this pull request was opened by an agent or violates policy. AI-assisted contributions are permitted, but automated tooling must not open pull requests without advance approval, and contributors must personally understand, test, verify, and take responsibility for every submitted change. See the AgentScan analysis, AI use policy, and automation policy for additional context.

[nikolas-sapa]

Could a collaborator trigger CI on this when convenient? Small fix with a regression test included.