Skip to content

meta: clarify V8 flags are outside threat model #64224

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mcollina wants to merge 1 commit into
base: main
Choose a base branch
from
+14 −5
Open

meta: clarify V8 flags are outside threat model #64224

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 14 additions & 5 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,23 +124,32 @@ This policy recognizes that experimental platforms may not compile, may not
pass the test suite, and do not have the same level of testing and support
infrastructure as Tier 1 and Tier 2 platforms.

### Experimental features behind compile-time flags
### Experimental features behind compile-time flags and V8 flags

Node.js includes certain experimental features that are only available when
Node.js is compiled with specific flags. These features are intended for
development, debugging, or testing purposes and are not enabled in official
releases.

Node.js may also expose V8 features that are controlled by V8 command-line flags
(e.g., `--js-staging`, `--max_old_space_size`). These flags
enable or modify V8-level JavaScript engine behavior that is not part of the
ECMAScript specification that Node.js implements and is not part of the
Node.js documented API surface.

* Security vulnerabilities that only affect features behind compile-time flags
will **not** be accepted as valid security issues.
or V8 flags will **not** be accepted as valid security issues.
* Any issues with these features will be treated as normal bugs.
* No CVEs will be issued for issues that only affect compile-time flag features.
* Bug bounty rewards are not available for compile-time flag feature issues.
* No CVEs will be issued for issues that only affect compile-time flag or V8 flag features.
* Bug bounty rewards are not available for compile-time flag or V8 flag feature issues.

This policy recognizes that experimental features behind compile-time flags
are not ready for public consumption and may have incomplete implementations,
missing security hardening, or other limitations that make them unsuitable
for production use.
for production use. Similarly, V8 flags expose internal V8 engine options that
are not part of the Node.js documented API surface, are not enabled by
default in production builds, and may have incomplete implementations or
missing security hardening.

### What constitutes a vulnerability

Expand Down
Loading