IPC “advanced” mode length parsing allows malformed frames to crash parent process

[HO-9]

Version

24.11.1

Platform

Linux

Subsystem

child_process

What steps will reproduce the bug?

run: node parent.js

parent.js

'use strict';

const { fork } = require('child_process');

const child = fork(require.resolve('./child.js'), {
  serialization: 'advanced',
  stdio: ['inherit', 'inherit', 'inherit', 'ipc'],
});

child.on('exit', (code, signal) => {
  console.log('child exit', code, signal);
});

setTimeout(() => {}, 60_000);

child.js

'use strict';

const fs = require('fs');

const fd = (process.channel && process.channel.fd) ?? Number(process.env.NODE_CHANNEL_FD);
if (!Number.isInteger(fd)) {
  throw new Error('IPC channel fd not available. Run via parent.js (fork with ipc).');
}

const payload = Buffer.from([0x80, 0x00, 0x00, 0x00]);
fs.writeSync(fd, payload);
process.exit(0);

How often does it reproduce? Is there a required condition?

Reproduces 100% with this PoC.
Required condition: fork() with { serialization: 'advanced' } and the child writes a malformed IPC length prefix (0x80000000)

What is the expected behavior? Why is that the expected behavior?

The parent process should not crash. It should reject or ignore malformed IPC frames and continue or fail gracefully.
IPC is an untrusted boundary between processes; malformed frames should be handled defensively rather than crashing the parent.

What do you see instead?

The parent process crashes at deserializer.readHeader().

node:internal/child_process/serialization:102
      deserializer.readHeader();
                   ^

Error: Unable to deserialize cloned data due to invalid or unsupported version.
    at parseChannelMessages (node:internal/child_process/serialization:102:20)
    at parseChannelMessages.next (<anonymous>)
    at channel.onread (node:internal/child_process:623:18)

Node.js v24.11.1

Additional information

Problematic code section (internal/child_process/serialization.js):

const fullMessageSize = (
  messageBufferHead[0] << 24 |
  messageBufferHead[1] << 16 |
  messageBufferHead[2] << 8 |
  messageBufferHead[3]
) + 4;

if (channel[kMessageBufferSize] < fullMessageSize) break;

const deserializer = new ChildProcessDeserializer(
  TypedArrayPrototypeSubarray(concatenatedBuffer, 4, fullMessageSize),
);

deserializer.readHeader();

The signed 32‑bit length parse allows negative sizes; the check is bypassed and deserialization of a truncated buffer throws.