From d92cd7cee8b51fc642ab63db6c51c361d9d8e705 Mon Sep 17 00:00:00 2001 From: iaohkut Date: Wed, 26 Aug 2026 01:32:54 +0700 Subject: [PATCH] Fix unhandled exception in request handling crashes the process (CWE-248/400) getOutputDirFilePath() throws Error("Invalid path") as its normal rejection path for an out-of-bounds request, but nothing in the call chain up to the raw http.Server request handler caught it, so the exception propagated as an unhandled promise rejection (onRequestHandler is async) and terminated the entire Node.js process on a single crafted GET request. Wrap the middleware-chain invocation in onRequestHandler in a try/catch and respond with a normal 400 instead of letting the exception escape. Verified against the existing test suite (32/32 passing) plus a PoC that previously killed the server with one request and now returns 400 while the server stays alive for subsequent requests. Co-Authored-By: iaohkut --- server.js | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/server.js b/server.js index d9de0c8..d8de2d9 100644 --- a/server.js +++ b/server.js @@ -851,7 +851,14 @@ export default class EleventyDevServer { bound.reverse(); let [first] = bound; - await first(); + try { + await first(); + } catch(e) { + if(!res.headersSent) { + res.statusCode = 400; + res.end("Bad Request"); + } + } } getHosts() {