quic: fixup UAFs in bindingdata, streams, and app

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63267
Backport-PR-URL: #64675
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Author: jasnell

src/quic/application.cc

@@ -369,7 +369,8 @@ void Session::Application::SendPendingData() {
 if (closed) return;
 // Flush any remaining accumulated packets before updating stats.
 flush_batch();
-if (session().is_destroyed()) [[unlikely]]return;
+if (session().is_destroyed()) [[unlikely]]
+return;
 
 // Get a strong pointer to protect against potential destruction during
 // updating the time and data stats.

src/quic/bindingdata.cc

@@ -149,21 +149,87 @@ void* Nghttp3Realloc(void* ptr, size_t size, void* ud) {
 }
 } // namespace
 
+// ============================================================================
+// CheckWrap / CheckWrapHandle
+
+voidCheckWrap::Start() {
+if (check_.data == nullptr) return;
+uv_check_start(&check_, OnCheck);
+}
+
+voidCheckWrap::Stop() {
+if (check_.data == nullptr) return;
+uv_check_stop(&check_);
+}
+
+voidCheckWrap::Close() {
+ check_.data = nullptr;
+ env_->CloseHandle(reinterpret_cast<uv_handle_t*>(&check_), CheckClosedCb);
+}
+
+voidCheckWrap::Ref() {
+if (check_.data == nullptr) return;
+uv_ref(reinterpret_cast<uv_handle_t*>(&check_));
+}
+
+voidCheckWrap::Unref() {
+if (check_.data == nullptr) return;
+uv_unref(reinterpret_cast<uv_handle_t*>(&check_));
+}
+
+voidCheckWrap::OnCheck(uv_check_t* check) {
+ CheckWrap* wrap = ContainerOf(&CheckWrap::check_, check);
+ wrap->fn_();
+}
+
+voidCheckWrap::CheckClosedCb(uv_handle_t* handle) {
+ std::unique_ptr<CheckWrap> ptr(
+ContainerOf(&CheckWrap::check_, reinterpret_cast<uv_check_t*>(handle)));
+}
+
+voidCheckWrapHandle::Start() {
+if (check_ != nullptr) check_->Start();
+}
+
+voidCheckWrapHandle::Stop() {
+if (check_ != nullptr) check_->Stop();
+}
+
+voidCheckWrapHandle::Close() {
+if (check_ != nullptr) {
+ check_->env()->RemoveCleanupHook(CleanupHook, this);
+ check_->Close();
+ }
+ check_ = nullptr;
+}
+
+voidCheckWrapHandle::Ref() {
+if (check_ != nullptr) check_->Ref();
+}
+
+voidCheckWrapHandle::Unref() {
+if (check_ != nullptr) check_->Unref();
+}
+
+voidCheckWrapHandle::MemoryInfo(MemoryTracker* tracker) const {
+if (check_ != nullptr) tracker->TrackField("check", *check_);
+}
+
+voidCheckWrapHandle::CleanupHook(void* data) {
+static_cast<CheckWrapHandle*>(data)->Close();
+}
+
+// ============================================================================
+
 BindingData& BindingData::Get(Environment* env) {
 return *(env->principal_realm()->GetBindingData<BindingData>());
 }
 
 BindingData::~BindingData() {
  quic_alloc_state.binding = nullptr;
-if (flush_check_initialized_) {
-uv_check_stop(&flush_check_);
- flush_check_started_ = false;
-// The check handle is closed inline here. Because BindingData destruction
-// happens during Environment cleanup, the handle will be finalized by
-// libuv's close phase.
-uv_close(reinterpret_cast<uv_handle_t*>(&flush_check_), nullptr);
- flush_check_initialized_ = false;
- }
+// flush_check_ is cleaned up by ~CheckWrapHandle() after the destructor
+// body completes. The inner CheckWrap (and its uv_check_t) will be freed
+// later by the uv_close callback, after CleanupHandles() runs uv_run().
  pending_flush_sessions_.clear();
 }
 
@@ -230,13 +296,11 @@ void BindingData::RegisterExternalReferences(
 }
 
 BindingData::BindingData(Realm* realm, Local<Object> object)
- : BaseObject(realm, object) {
+ : BaseObject(realm, object),
+flush_check_(env(), [this]() { OnFlushCheck(); }) {
 MakeWeak();
-CHECK_EQ(uv_check_init(env()->event_loop(), &flush_check_), 0);
- flush_check_.data = this;
 // Unref so the check handle doesn't keep the event loop alive on its own.
-uv_unref(reinterpret_cast<uv_handle_t*>(&flush_check_));
- flush_check_initialized_ = true;
+ flush_check_.Unref();
 }
 
 SessionManager& BindingData::session_manager() {
@@ -249,27 +313,26 @@ SessionManager& BindingData::session_manager() {
 voidBindingData::ScheduleSessionFlush(const BaseObjectPtr<Session>& session) {
  pending_flush_sessions_.push_back(session);
 if (!flush_check_started_) {
-uv_check_start(&flush_check_, OnFlushCheck);
+ flush_check_.Start();
  flush_check_started_ = true;
  }
 }
 
-voidBindingData::OnFlushCheck(uv_check_t* handle) {
-auto* binding = static_cast<BindingData*>(handle->data);
-if (binding->pending_flush_sessions_.empty()) {
-uv_check_stop(&binding->flush_check_);
- binding->flush_check_started_ = false;
+voidBindingData::OnFlushCheck() {
+if (pending_flush_sessions_.empty()) {
+ flush_check_.Stop();
+ flush_check_started_ = false;
 return;
  }
 
- HandleScope scope(binding->env()->isolate());
+ HandleScope scope(env()->isolate());
 
 // Swap to a local vector before iterating. SendPendingData may trigger
 // MakeCallback which runs JS that could cause more packet receives via
 // re-entry (e.g., a stream data callback that synchronously writes to
 // another session). Any sessions added during the flush remain in
 // pending_flush_sessions_ and are picked up on the next check tick.
-auto sessions = std::move(binding->pending_flush_sessions_);
+auto sessions = std::move(pending_flush_sessions_);
 for (auto& session : sessions) {
  session->pending_flush_ = false;
 if (!session->is_destroyed()) {
@@ -279,9 +342,9 @@ void BindingData::OnFlushCheck(uv_check_t* handle) {
 
 // If no new sessions were added during the flush, stop the check
 // to avoid per-tick callback overhead when idle.
-if (binding->pending_flush_sessions_.empty()) {
-uv_check_stop(&binding->flush_check_);
-binding->flush_check_started_ = false;
+if (pending_flush_sessions_.empty()) {
+ flush_check_.Stop();
+ flush_check_started_ = false;
  }
 }
 

src/quic/bindingdata.h

@@ -12,6 +12,7 @@
 #include<node_mem.h>
 #include<uv.h>
 #include<v8.h>
+#include<functional>
 #include<memory>
 #include<unordered_map>
 #include<vector>
@@ -157,6 +158,81 @@ class SessionManager;
 V(verify_private_key, "verifyPrivateKey") \
 V(version, "version")
 
+// =============================================================================
+// Lightweight wrappers around uv_check_t that ensure safe handle closure.
+// The check handle is embedded in a heap-allocated CheckWrap whose destruction
+// is deferred until the uv_close callback fires, preventing use-after-free
+// when the owning object is destroyed before libuv finishes closing the handle.
+// Follows the same two-layer pattern as TimerWrap / TimerWrapHandle
+// (see timer_wrap.h).
+// TODO(@jasnell): Consider moving it out to a separate file like timer_wrap.h.
+classCheckWrapfinal : public MemoryRetainer {
+public:
+using CheckCb = std::function<void()>;
+
+template <typename... Args>
+explicitCheckWrap(Environment* env, Args&&... args)
+ : env_(env), fn_(std::forward<Args>(args)...) {
+uv_check_init(env->event_loop(), &check_);
+ check_.data = this;
+ }
+
+DISALLOW_COPY_AND_MOVE(CheckWrap)
+
+inline Environment* env() const { return env_; }
+
+voidStart();
+voidStop();
+voidClose();
+voidRef();
+voidUnref();
+
+SET_NO_MEMORY_INFO()
+SET_MEMORY_INFO_NAME(CheckWrap)
+SET_SELF_SIZE(CheckWrap)
+
+private:
+staticvoidOnCheck(uv_check_t* check);
+staticvoidCheckClosedCb(uv_handle_t* handle);
+~CheckWrap() = default;
+
+ Environment* env_;
+ CheckCb fn_;
+uv_check_t check_;
+
+friend std::unique_ptr<CheckWrap>::deleter_type;
+};
+
+classCheckWrapHandle : publicMemoryRetainer {
+public:
+template <typename... Args>
+explicitCheckWrapHandle(Environment* env, Args&&... args)
+ : check_(new CheckWrap(env, std::forward<Args>(args)...)) {
+ env->AddCleanupHook(CleanupHook, this);
+ }
+
+DISALLOW_COPY_AND_MOVE(CheckWrapHandle)
+
+~CheckWrapHandle() { Close(); }
+
+inlineoperatorbool() const { return check_ != nullptr; }
+
+voidStart();
+voidStop();
+voidClose();
+voidRef();
+voidUnref();
+
+voidMemoryInfo(node::MemoryTracker* tracker) constoverride;
+
+SET_MEMORY_INFO_NAME(CheckWrapHandle)
+SET_SELF_SIZE(CheckWrapHandle)
+
+private:
+staticvoidCleanupHook(void* data);
+ CheckWrap* check_;
+};
+
 // =============================================================================
 // The BindingState object holds state for the internalBinding('quic') binding
 // instance. It is mostly used to hold the persistent constructors, strings, and
@@ -271,16 +347,15 @@ class BindingData final
  ArenaPtr endpoint_state_arena_{nullptr, +[](void*) {}};
  ArenaPtr endpoint_stats_arena_{nullptr, +[](void*) {}};
 
-// Deferred send flush state. The uv_check_t fires immediately after
+// Deferred send flush state. The CheckWrapHandle fires immediately after
 // the I/O poll phase in the same event loop tick, allowing batched
 // receive processing: all packets are read during poll, then
 // SendPendingData is called once per dirty session in the check callback.
-uv_check_t flush_check_;
+CheckWrapHandle flush_check_;
  std::vector<BaseObjectPtr<Session>> pending_flush_sessions_;
 bool flush_check_started_ = false;
-bool flush_check_initialized_ = false;
 
-staticvoidOnFlushCheck(uv_check_t* handle);
+voidOnFlushCheck();
 };
 
 JS_METHOD_IMPL(IllegalConstructor);

src/quic/streams.cc

@@ -1563,8 +1563,11 @@ void Stream::Destroy(QuicError error) {
 auto session = session_;
  session_.reset();
 // EmitClose above triggers MakeCallback which can destroy the session
-// via JS re-entrancy. The weak pointer may now be null.
-if (session) session->RemoveStream(id());
+// via JS re-entrancy. The weak pointer may still be non-null (the
+// Session BaseObject can be kept alive by a BaseObjectPtr elsewhere,
+// e.g. OnTimeout's ref) even though impl_ has been reset. We must
+// check is_destroyed() to avoid dereferencing the null impl_.
+if (session && !session->is_destroyed()) session->RemoveStream(id());
 
 // Critically, make sure that the RemoveStream call is the last thing
 // trying to use this stream object. Once that call is made, the stream

src/quic/application.cc

@@ -369,7 +369,8 @@ void Session::Application::SendPendingData() {
 if (closed) return;
 // Flush any remaining accumulated packets before updating stats.
 flush_batch();
-if (session().is_destroyed()) [[unlikely]]return;
+if (session().is_destroyed()) [[unlikely]]
+return;
 
 // Get a strong pointer to protect against potential destruction during
 // updating the time and data stats.

src/quic/bindingdata.cc

@@ -149,21 +149,87 @@ void* Nghttp3Realloc(void* ptr, size_t size, void* ud) {
 }
 } // namespace
 
+// ============================================================================
+// CheckWrap / CheckWrapHandle
+
+voidCheckWrap::Start() {
+if (check_.data == nullptr) return;
+uv_check_start(&check_, OnCheck);
+}
+
+voidCheckWrap::Stop() {
+if (check_.data == nullptr) return;
+uv_check_stop(&check_);
+}
+
+voidCheckWrap::Close() {
+ check_.data = nullptr;
+ env_->CloseHandle(reinterpret_cast<uv_handle_t*>(&check_), CheckClosedCb);
+}
+
+voidCheckWrap::Ref() {
+if (check_.data == nullptr) return;
+uv_ref(reinterpret_cast<uv_handle_t*>(&check_));
+}
+
+voidCheckWrap::Unref() {
+if (check_.data == nullptr) return;
+uv_unref(reinterpret_cast<uv_handle_t*>(&check_));
+}
+
+voidCheckWrap::OnCheck(uv_check_t* check) {
+ CheckWrap* wrap = ContainerOf(&CheckWrap::check_, check);
+ wrap->fn_();
+}
+
+voidCheckWrap::CheckClosedCb(uv_handle_t* handle) {
+ std::unique_ptr<CheckWrap> ptr(
+ContainerOf(&CheckWrap::check_, reinterpret_cast<uv_check_t*>(handle)));
+}
+
+voidCheckWrapHandle::Start() {
+if (check_ != nullptr) check_->Start();
+}
+
+voidCheckWrapHandle::Stop() {
+if (check_ != nullptr) check_->Stop();
+}
+
+voidCheckWrapHandle::Close() {
+if (check_ != nullptr) {
+ check_->env()->RemoveCleanupHook(CleanupHook, this);
+ check_->Close();
+ }
+ check_ = nullptr;
+}
+
+voidCheckWrapHandle::Ref() {
+if (check_ != nullptr) check_->Ref();
+}
+
+voidCheckWrapHandle::Unref() {
+if (check_ != nullptr) check_->Unref();
+}
+
+voidCheckWrapHandle::MemoryInfo(MemoryTracker* tracker) const {
+if (check_ != nullptr) tracker->TrackField("check", *check_);
+}
+
+voidCheckWrapHandle::CleanupHook(void* data) {
+static_cast<CheckWrapHandle*>(data)->Close();
+}
+
+// ============================================================================
+
 BindingData& BindingData::Get(Environment* env) {
 return *(env->principal_realm()->GetBindingData<BindingData>());
 }
 
 BindingData::~BindingData() {
  quic_alloc_state.binding = nullptr;
-if (flush_check_initialized_) {
-uv_check_stop(&flush_check_);
- flush_check_started_ = false;
-// The check handle is closed inline here. Because BindingData destruction
-// happens during Environment cleanup, the handle will be finalized by
-// libuv's close phase.
-uv_close(reinterpret_cast<uv_handle_t*>(&flush_check_), nullptr);
- flush_check_initialized_ = false;
- }
+// flush_check_ is cleaned up by ~CheckWrapHandle() after the destructor
+// body completes. The inner CheckWrap (and its uv_check_t) will be freed
+// later by the uv_close callback, after CleanupHandles() runs uv_run().
  pending_flush_sessions_.clear();
 }
 
@@ -230,13 +296,11 @@ void BindingData::RegisterExternalReferences(
 }
 
 BindingData::BindingData(Realm* realm, Local<Object> object)
- : BaseObject(realm, object) {
+ : BaseObject(realm, object),
+flush_check_(env(), [this]() { OnFlushCheck(); }) {
 MakeWeak();
-CHECK_EQ(uv_check_init(env()->event_loop(), &flush_check_), 0);
- flush_check_.data = this;
 // Unref so the check handle doesn't keep the event loop alive on its own.
-uv_unref(reinterpret_cast<uv_handle_t*>(&flush_check_));
- flush_check_initialized_ = true;
+ flush_check_.Unref();
 }
 
 SessionManager& BindingData::session_manager() {
@@ -249,27 +313,26 @@ SessionManager& BindingData::session_manager() {
 voidBindingData::ScheduleSessionFlush(const BaseObjectPtr<Session>& session) {
  pending_flush_sessions_.push_back(session);
 if (!flush_check_started_) {
-uv_check_start(&flush_check_, OnFlushCheck);
+ flush_check_.Start();
  flush_check_started_ = true;
  }
 }
 
-voidBindingData::OnFlushCheck(uv_check_t* handle) {
-auto* binding = static_cast<BindingData*>(handle->data);
-if (binding->pending_flush_sessions_.empty()) {
-uv_check_stop(&binding->flush_check_);
- binding->flush_check_started_ = false;
+voidBindingData::OnFlushCheck() {
+if (pending_flush_sessions_.empty()) {
+ flush_check_.Stop();
+ flush_check_started_ = false;
 return;
  }
 
- HandleScope scope(binding->env()->isolate());
+ HandleScope scope(env()->isolate());
 
 // Swap to a local vector before iterating. SendPendingData may trigger
 // MakeCallback which runs JS that could cause more packet receives via
 // re-entry (e.g., a stream data callback that synchronously writes to
 // another session). Any sessions added during the flush remain in
 // pending_flush_sessions_ and are picked up on the next check tick.
-auto sessions = std::move(binding->pending_flush_sessions_);
+auto sessions = std::move(pending_flush_sessions_);
 for (auto& session : sessions) {
  session->pending_flush_ = false;
 if (!session->is_destroyed()) {
@@ -279,9 +342,9 @@ void BindingData::OnFlushCheck(uv_check_t* handle) {
 
 // If no new sessions were added during the flush, stop the check
 // to avoid per-tick callback overhead when idle.
-if (binding->pending_flush_sessions_.empty()) {
-uv_check_stop(&binding->flush_check_);
-binding->flush_check_started_ = false;
+if (pending_flush_sessions_.empty()) {
+ flush_check_.Stop();
+ flush_check_started_ = false;
  }
 }
 

src/quic/bindingdata.h

@@ -12,6 +12,7 @@
 #include<node_mem.h>
 #include<uv.h>
 #include<v8.h>
+#include<functional>
 #include<memory>
 #include<unordered_map>
 #include<vector>
@@ -157,6 +158,81 @@ class SessionManager;
 V(verify_private_key, "verifyPrivateKey") \
 V(version, "version")
 
+// =============================================================================
+// Lightweight wrappers around uv_check_t that ensure safe handle closure.
+// The check handle is embedded in a heap-allocated CheckWrap whose destruction
+// is deferred until the uv_close callback fires, preventing use-after-free
+// when the owning object is destroyed before libuv finishes closing the handle.
+// Follows the same two-layer pattern as TimerWrap / TimerWrapHandle
+// (see timer_wrap.h).
+// TODO(@jasnell): Consider moving it out to a separate file like timer_wrap.h.
+classCheckWrapfinal : public MemoryRetainer {
+public:
+using CheckCb = std::function<void()>;
+
+template <typename... Args>
+explicitCheckWrap(Environment* env, Args&&... args)
+ : env_(env), fn_(std::forward<Args>(args)...) {
+uv_check_init(env->event_loop(), &check_);
+ check_.data = this;
+ }
+
+DISALLOW_COPY_AND_MOVE(CheckWrap)
+
+inline Environment* env() const { return env_; }
+
+voidStart();
+voidStop();
+voidClose();
+voidRef();
+voidUnref();
+
+SET_NO_MEMORY_INFO()
+SET_MEMORY_INFO_NAME(CheckWrap)
+SET_SELF_SIZE(CheckWrap)
+
+private:
+staticvoidOnCheck(uv_check_t* check);
+staticvoidCheckClosedCb(uv_handle_t* handle);
+~CheckWrap() = default;
+
+ Environment* env_;
+ CheckCb fn_;
+uv_check_t check_;
+
+friend std::unique_ptr<CheckWrap>::deleter_type;
+};
+
+classCheckWrapHandle : publicMemoryRetainer {
+public:
+template <typename... Args>
+explicitCheckWrapHandle(Environment* env, Args&&... args)
+ : check_(new CheckWrap(env, std::forward<Args>(args)...)) {
+ env->AddCleanupHook(CleanupHook, this);
+ }
+
+DISALLOW_COPY_AND_MOVE(CheckWrapHandle)
+
+~CheckWrapHandle() { Close(); }
+
+inlineoperatorbool() const { return check_ != nullptr; }
+
+voidStart();
+voidStop();
+voidClose();
+voidRef();
+voidUnref();
+
+voidMemoryInfo(node::MemoryTracker* tracker) constoverride;
+
+SET_MEMORY_INFO_NAME(CheckWrapHandle)
+SET_SELF_SIZE(CheckWrapHandle)
+
+private:
+staticvoidCleanupHook(void* data);
+ CheckWrap* check_;
+};
+
 // =============================================================================
 // The BindingState object holds state for the internalBinding('quic') binding
 // instance. It is mostly used to hold the persistent constructors, strings, and
@@ -271,16 +347,15 @@ class BindingData final
  ArenaPtr endpoint_state_arena_{nullptr, +[](void*) {}};
  ArenaPtr endpoint_stats_arena_{nullptr, +[](void*) {}};
 
-// Deferred send flush state. The uv_check_t fires immediately after
+// Deferred send flush state. The CheckWrapHandle fires immediately after
 // the I/O poll phase in the same event loop tick, allowing batched
 // receive processing: all packets are read during poll, then
 // SendPendingData is called once per dirty session in the check callback.
-uv_check_t flush_check_;
+CheckWrapHandle flush_check_;
  std::vector<BaseObjectPtr<Session>> pending_flush_sessions_;
 bool flush_check_started_ = false;
-bool flush_check_initialized_ = false;
 
-staticvoidOnFlushCheck(uv_check_t* handle);
+voidOnFlushCheck();
 };
 
 JS_METHOD_IMPL(IllegalConstructor);

src/quic/streams.cc

@@ -1563,8 +1563,11 @@ void Stream::Destroy(QuicError error) {
 auto session = session_;
  session_.reset();
 // EmitClose above triggers MakeCallback which can destroy the session
-// via JS re-entrancy. The weak pointer may now be null.
-if (session) session->RemoveStream(id());
+// via JS re-entrancy. The weak pointer may still be non-null (the
+// Session BaseObject can be kept alive by a BaseObjectPtr elsewhere,
+// e.g. OnTimeout's ref) even though impl_ has been reset. We must
+// check is_destroyed() to avoid dereferencing the null impl_.
+if (session && !session->is_destroyed()) session->RemoveStream(id());
 
 // Critically, make sure that the RemoveStream call is the last thing
 // trying to use this stream object. Once that call is made, the stream

src/quic/application.cc

@@ -369,7 +369,8 @@ void Session::Application::SendPendingData() {
 if (closed) return;
 // Flush any remaining accumulated packets before updating stats.
 flush_batch();
-if (session().is_destroyed()) [[unlikely]]return;
+if (session().is_destroyed()) [[unlikely]]
+return;
 
 // Get a strong pointer to protect against potential destruction during
 // updating the time and data stats.

src/quic/bindingdata.cc

@@ -149,21 +149,87 @@ void* Nghttp3Realloc(void* ptr, size_t size, void* ud) {
 }
 } // namespace
 
+// ============================================================================
+// CheckWrap / CheckWrapHandle
+
+voidCheckWrap::Start() {
+if (check_.data == nullptr) return;
+uv_check_start(&check_, OnCheck);
+}
+
+voidCheckWrap::Stop() {
+if (check_.data == nullptr) return;
+uv_check_stop(&check_);
+}
+
+voidCheckWrap::Close() {
+ check_.data = nullptr;
+ env_->CloseHandle(reinterpret_cast<uv_handle_t*>(&check_), CheckClosedCb);
+}
+
+voidCheckWrap::Ref() {
+if (check_.data == nullptr) return;
+uv_ref(reinterpret_cast<uv_handle_t*>(&check_));
+}
+
+voidCheckWrap::Unref() {
+if (check_.data == nullptr) return;
+uv_unref(reinterpret_cast<uv_handle_t*>(&check_));
+}
+
+voidCheckWrap::OnCheck(uv_check_t* check) {
+ CheckWrap* wrap = ContainerOf(&CheckWrap::check_, check);
+ wrap->fn_();
+}
+
+voidCheckWrap::CheckClosedCb(uv_handle_t* handle) {
+ std::unique_ptr<CheckWrap> ptr(
+ContainerOf(&CheckWrap::check_, reinterpret_cast<uv_check_t*>(handle)));
+}
+
+voidCheckWrapHandle::Start() {
+if (check_ != nullptr) check_->Start();
+}
+
+voidCheckWrapHandle::Stop() {
+if (check_ != nullptr) check_->Stop();
+}
+
+voidCheckWrapHandle::Close() {
+if (check_ != nullptr) {
+ check_->env()->RemoveCleanupHook(CleanupHook, this);
+ check_->Close();
+ }
+ check_ = nullptr;
+}
+
+voidCheckWrapHandle::Ref() {
+if (check_ != nullptr) check_->Ref();
+}
+
+voidCheckWrapHandle::Unref() {
+if (check_ != nullptr) check_->Unref();
+}
+
+voidCheckWrapHandle::MemoryInfo(MemoryTracker* tracker) const {
+if (check_ != nullptr) tracker->TrackField("check", *check_);
+}
+
+voidCheckWrapHandle::CleanupHook(void* data) {
+static_cast<CheckWrapHandle*>(data)->Close();
+}
+
+// ============================================================================
+
 BindingData& BindingData::Get(Environment* env) {
 return *(env->principal_realm()->GetBindingData<BindingData>());
 }
 
 BindingData::~BindingData() {
  quic_alloc_state.binding = nullptr;
-if (flush_check_initialized_) {
-uv_check_stop(&flush_check_);
- flush_check_started_ = false;
-// The check handle is closed inline here. Because BindingData destruction
-// happens during Environment cleanup, the handle will be finalized by
-// libuv's close phase.
-uv_close(reinterpret_cast<uv_handle_t*>(&flush_check_), nullptr);
- flush_check_initialized_ = false;
- }
+// flush_check_ is cleaned up by ~CheckWrapHandle() after the destructor
+// body completes. The inner CheckWrap (and its uv_check_t) will be freed
+// later by the uv_close callback, after CleanupHandles() runs uv_run().
  pending_flush_sessions_.clear();
 }
 
@@ -230,13 +296,11 @@ void BindingData::RegisterExternalReferences(
 }
 
 BindingData::BindingData(Realm* realm, Local<Object> object)
- : BaseObject(realm, object) {
+ : BaseObject(realm, object),
+flush_check_(env(), [this]() { OnFlushCheck(); }) {
 MakeWeak();
-CHECK_EQ(uv_check_init(env()->event_loop(), &flush_check_), 0);
- flush_check_.data = this;
 // Unref so the check handle doesn't keep the event loop alive on its own.
-uv_unref(reinterpret_cast<uv_handle_t*>(&flush_check_));
- flush_check_initialized_ = true;
+ flush_check_.Unref();
 }
 
 SessionManager& BindingData::session_manager() {
@@ -249,27 +313,26 @@ SessionManager& BindingData::session_manager() {
 voidBindingData::ScheduleSessionFlush(const BaseObjectPtr<Session>& session) {
  pending_flush_sessions_.push_back(session);
 if (!flush_check_started_) {
-uv_check_start(&flush_check_, OnFlushCheck);
+ flush_check_.Start();
  flush_check_started_ = true;
  }
 }
 
-voidBindingData::OnFlushCheck(uv_check_t* handle) {
-auto* binding = static_cast<BindingData*>(handle->data);
-if (binding->pending_flush_sessions_.empty()) {
-uv_check_stop(&binding->flush_check_);
- binding->flush_check_started_ = false;
+voidBindingData::OnFlushCheck() {
+if (pending_flush_sessions_.empty()) {
+ flush_check_.Stop();
+ flush_check_started_ = false;
 return;
  }
 
- HandleScope scope(binding->env()->isolate());
+ HandleScope scope(env()->isolate());
 
 // Swap to a local vector before iterating. SendPendingData may trigger
 // MakeCallback which runs JS that could cause more packet receives via
 // re-entry (e.g., a stream data callback that synchronously writes to
 // another session). Any sessions added during the flush remain in
 // pending_flush_sessions_ and are picked up on the next check tick.
-auto sessions = std::move(binding->pending_flush_sessions_);
+auto sessions = std::move(pending_flush_sessions_);
 for (auto& session : sessions) {
  session->pending_flush_ = false;
 if (!session->is_destroyed()) {
@@ -279,9 +342,9 @@ void BindingData::OnFlushCheck(uv_check_t* handle) {
 
 // If no new sessions were added during the flush, stop the check
 // to avoid per-tick callback overhead when idle.
-if (binding->pending_flush_sessions_.empty()) {
-uv_check_stop(&binding->flush_check_);
-binding->flush_check_started_ = false;
+if (pending_flush_sessions_.empty()) {
+ flush_check_.Stop();
+ flush_check_started_ = false;
  }
 }
 

src/quic/bindingdata.h

@@ -12,6 +12,7 @@
 #include<node_mem.h>
 #include<uv.h>
 #include<v8.h>
+#include<functional>
 #include<memory>
 #include<unordered_map>
 #include<vector>
@@ -157,6 +158,81 @@ class SessionManager;
 V(verify_private_key, "verifyPrivateKey") \
 V(version, "version")
 
+// =============================================================================
+// Lightweight wrappers around uv_check_t that ensure safe handle closure.
+// The check handle is embedded in a heap-allocated CheckWrap whose destruction
+// is deferred until the uv_close callback fires, preventing use-after-free
+// when the owning object is destroyed before libuv finishes closing the handle.
+// Follows the same two-layer pattern as TimerWrap / TimerWrapHandle
+// (see timer_wrap.h).
+// TODO(@jasnell): Consider moving it out to a separate file like timer_wrap.h.
+classCheckWrapfinal : public MemoryRetainer {
+public:
+using CheckCb = std::function<void()>;
+
+template <typename... Args>
+explicitCheckWrap(Environment* env, Args&&... args)
+ : env_(env), fn_(std::forward<Args>(args)...) {
+uv_check_init(env->event_loop(), &check_);
+ check_.data = this;
+ }
+
+DISALLOW_COPY_AND_MOVE(CheckWrap)
+
+inline Environment* env() const { return env_; }
+
+voidStart();
+voidStop();
+voidClose();
+voidRef();
+voidUnref();
+
+SET_NO_MEMORY_INFO()
+SET_MEMORY_INFO_NAME(CheckWrap)
+SET_SELF_SIZE(CheckWrap)
+
+private:
+staticvoidOnCheck(uv_check_t* check);
+staticvoidCheckClosedCb(uv_handle_t* handle);
+~CheckWrap() = default;
+
+ Environment* env_;
+ CheckCb fn_;
+uv_check_t check_;
+
+friend std::unique_ptr<CheckWrap>::deleter_type;
+};
+
+classCheckWrapHandle : publicMemoryRetainer {
+public:
+template <typename... Args>
+explicitCheckWrapHandle(Environment* env, Args&&... args)
+ : check_(new CheckWrap(env, std::forward<Args>(args)...)) {
+ env->AddCleanupHook(CleanupHook, this);
+ }
+
+DISALLOW_COPY_AND_MOVE(CheckWrapHandle)
+
+~CheckWrapHandle() { Close(); }
+
+inlineoperatorbool() const { return check_ != nullptr; }
+
+voidStart();
+voidStop();
+voidClose();
+voidRef();
+voidUnref();
+
+voidMemoryInfo(node::MemoryTracker* tracker) constoverride;
+
+SET_MEMORY_INFO_NAME(CheckWrapHandle)
+SET_SELF_SIZE(CheckWrapHandle)
+
+private:
+staticvoidCleanupHook(void* data);
+ CheckWrap* check_;
+};
+
 // =============================================================================
 // The BindingState object holds state for the internalBinding('quic') binding
 // instance. It is mostly used to hold the persistent constructors, strings, and
@@ -271,16 +347,15 @@ class BindingData final
  ArenaPtr endpoint_state_arena_{nullptr, +[](void*) {}};
  ArenaPtr endpoint_stats_arena_{nullptr, +[](void*) {}};
 
-// Deferred send flush state. The uv_check_t fires immediately after
+// Deferred send flush state. The CheckWrapHandle fires immediately after
 // the I/O poll phase in the same event loop tick, allowing batched
 // receive processing: all packets are read during poll, then
 // SendPendingData is called once per dirty session in the check callback.
-uv_check_t flush_check_;
+CheckWrapHandle flush_check_;
  std::vector<BaseObjectPtr<Session>> pending_flush_sessions_;
 bool flush_check_started_ = false;
-bool flush_check_initialized_ = false;
 
-staticvoidOnFlushCheck(uv_check_t* handle);
+voidOnFlushCheck();
 };
 
 JS_METHOD_IMPL(IllegalConstructor);

src/quic/streams.cc

@@ -1563,8 +1563,11 @@ void Stream::Destroy(QuicError error) {
 auto session = session_;
  session_.reset();
 // EmitClose above triggers MakeCallback which can destroy the session
-// via JS re-entrancy. The weak pointer may now be null.
-if (session) session->RemoveStream(id());
+// via JS re-entrancy. The weak pointer may still be non-null (the
+// Session BaseObject can be kept alive by a BaseObjectPtr elsewhere,
+// e.g. OnTimeout's ref) even though impl_ has been reset. We must
+// check is_destroyed() to avoid dereferencing the null impl_.
+if (session && !session->is_destroyed()) session->RemoveStream(id());
 
 // Critically, make sure that the RemoveStream call is the last thing
 // trying to use this stream object. Once that call is made, the stream

src/quic/application.cc

@@ -369,7 +369,8 @@ void Session::Application::SendPendingData() {
 if (closed) return;
 // Flush any remaining accumulated packets before updating stats.
 flush_batch();
-if (session().is_destroyed()) [[unlikely]]return;
+if (session().is_destroyed()) [[unlikely]]
+return;
 
 // Get a strong pointer to protect against potential destruction during
 // updating the time and data stats.

src/quic/bindingdata.cc

@@ -149,21 +149,87 @@ void* Nghttp3Realloc(void* ptr, size_t size, void* ud) {
 }
 } // namespace
 
+// ============================================================================
+// CheckWrap / CheckWrapHandle
+
+voidCheckWrap::Start() {
+if (check_.data == nullptr) return;
+uv_check_start(&check_, OnCheck);
+}
+
+voidCheckWrap::Stop() {
+if (check_.data == nullptr) return;
+uv_check_stop(&check_);
+}
+
+voidCheckWrap::Close() {
+ check_.data = nullptr;
+ env_->CloseHandle(reinterpret_cast<uv_handle_t*>(&check_), CheckClosedCb);
+}
+
+voidCheckWrap::Ref() {
+if (check_.data == nullptr) return;
+uv_ref(reinterpret_cast<uv_handle_t*>(&check_));
+}
+
+voidCheckWrap::Unref() {
+if (check_.data == nullptr) return;
+uv_unref(reinterpret_cast<uv_handle_t*>(&check_));
+}
+
+voidCheckWrap::OnCheck(uv_check_t* check) {
+ CheckWrap* wrap = ContainerOf(&CheckWrap::check_, check);
+ wrap->fn_();
+}
+
+voidCheckWrap::CheckClosedCb(uv_handle_t* handle) {
+ std::unique_ptr<CheckWrap> ptr(
+ContainerOf(&CheckWrap::check_, reinterpret_cast<uv_check_t*>(handle)));
+}
+
+voidCheckWrapHandle::Start() {
+if (check_ != nullptr) check_->Start();
+}
+
+voidCheckWrapHandle::Stop() {
+if (check_ != nullptr) check_->Stop();
+}
+
+voidCheckWrapHandle::Close() {
+if (check_ != nullptr) {
+ check_->env()->RemoveCleanupHook(CleanupHook, this);
+ check_->Close();
+ }
+ check_ = nullptr;
+}
+
+voidCheckWrapHandle::Ref() {
+if (check_ != nullptr) check_->Ref();
+}
+
+voidCheckWrapHandle::Unref() {
+if (check_ != nullptr) check_->Unref();
+}
+
+voidCheckWrapHandle::MemoryInfo(MemoryTracker* tracker) const {
+if (check_ != nullptr) tracker->TrackField("check", *check_);
+}
+
+voidCheckWrapHandle::CleanupHook(void* data) {
+static_cast<CheckWrapHandle*>(data)->Close();
+}
+
+// ============================================================================
+
 BindingData& BindingData::Get(Environment* env) {
 return *(env->principal_realm()->GetBindingData<BindingData>());
 }
 
 BindingData::~BindingData() {
  quic_alloc_state.binding = nullptr;
-if (flush_check_initialized_) {
-uv_check_stop(&flush_check_);
- flush_check_started_ = false;
-// The check handle is closed inline here. Because BindingData destruction
-// happens during Environment cleanup, the handle will be finalized by
-// libuv's close phase.
-uv_close(reinterpret_cast<uv_handle_t*>(&flush_check_), nullptr);
- flush_check_initialized_ = false;
- }
+// flush_check_ is cleaned up by ~CheckWrapHandle() after the destructor
+// body completes. The inner CheckWrap (and its uv_check_t) will be freed
+// later by the uv_close callback, after CleanupHandles() runs uv_run().
  pending_flush_sessions_.clear();
 }
 
@@ -230,13 +296,11 @@ void BindingData::RegisterExternalReferences(
 }
 
 BindingData::BindingData(Realm* realm, Local<Object> object)
- : BaseObject(realm, object) {
+ : BaseObject(realm, object),
+flush_check_(env(), [this]() { OnFlushCheck(); }) {
 MakeWeak();
-CHECK_EQ(uv_check_init(env()->event_loop(), &flush_check_), 0);
- flush_check_.data = this;
 // Unref so the check handle doesn't keep the event loop alive on its own.
-uv_unref(reinterpret_cast<uv_handle_t*>(&flush_check_));
- flush_check_initialized_ = true;
+ flush_check_.Unref();
 }
 
 SessionManager& BindingData::session_manager() {
@@ -249,27 +313,26 @@ SessionManager& BindingData::session_manager() {
 voidBindingData::ScheduleSessionFlush(const BaseObjectPtr<Session>& session) {
  pending_flush_sessions_.push_back(session);
 if (!flush_check_started_) {
-uv_check_start(&flush_check_, OnFlushCheck);
+ flush_check_.Start();
  flush_check_started_ = true;
  }
 }
 
-voidBindingData::OnFlushCheck(uv_check_t* handle) {
-auto* binding = static_cast<BindingData*>(handle->data);
-if (binding->pending_flush_sessions_.empty()) {
-uv_check_stop(&binding->flush_check_);
- binding->flush_check_started_ = false;
+voidBindingData::OnFlushCheck() {
+if (pending_flush_sessions_.empty()) {
+ flush_check_.Stop();
+ flush_check_started_ = false;
 return;
  }
 
- HandleScope scope(binding->env()->isolate());
+ HandleScope scope(env()->isolate());
 
 // Swap to a local vector before iterating. SendPendingData may trigger
 // MakeCallback which runs JS that could cause more packet receives via
 // re-entry (e.g., a stream data callback that synchronously writes to
 // another session). Any sessions added during the flush remain in
 // pending_flush_sessions_ and are picked up on the next check tick.
-auto sessions = std::move(binding->pending_flush_sessions_);
+auto sessions = std::move(pending_flush_sessions_);
 for (auto& session : sessions) {
  session->pending_flush_ = false;
 if (!session->is_destroyed()) {
@@ -279,9 +342,9 @@ void BindingData::OnFlushCheck(uv_check_t* handle) {
 
 // If no new sessions were added during the flush, stop the check
 // to avoid per-tick callback overhead when idle.
-if (binding->pending_flush_sessions_.empty()) {
-uv_check_stop(&binding->flush_check_);
-binding->flush_check_started_ = false;
+if (pending_flush_sessions_.empty()) {
+ flush_check_.Stop();
+ flush_check_started_ = false;
  }
 }
 

src/quic/bindingdata.h

@@ -12,6 +12,7 @@
 #include<node_mem.h>
 #include<uv.h>
 #include<v8.h>
+#include<functional>
 #include<memory>
 #include<unordered_map>
 #include<vector>
@@ -157,6 +158,81 @@ class SessionManager;
 V(verify_private_key, "verifyPrivateKey") \
 V(version, "version")
 
+// =============================================================================
+// Lightweight wrappers around uv_check_t that ensure safe handle closure.
+// The check handle is embedded in a heap-allocated CheckWrap whose destruction
+// is deferred until the uv_close callback fires, preventing use-after-free
+// when the owning object is destroyed before libuv finishes closing the handle.
+// Follows the same two-layer pattern as TimerWrap / TimerWrapHandle
+// (see timer_wrap.h).
+// TODO(@jasnell): Consider moving it out to a separate file like timer_wrap.h.
+classCheckWrapfinal : public MemoryRetainer {
+public:
+using CheckCb = std::function<void()>;
+
+template <typename... Args>
+explicitCheckWrap(Environment* env, Args&&... args)
+ : env_(env), fn_(std::forward<Args>(args)...) {
+uv_check_init(env->event_loop(), &check_);
+ check_.data = this;
+ }
+
+DISALLOW_COPY_AND_MOVE(CheckWrap)
+
+inline Environment* env() const { return env_; }
+
+voidStart();
+voidStop();
+voidClose();
+voidRef();
+voidUnref();
+
+SET_NO_MEMORY_INFO()
+SET_MEMORY_INFO_NAME(CheckWrap)
+SET_SELF_SIZE(CheckWrap)
+
+private:
+staticvoidOnCheck(uv_check_t* check);
+staticvoidCheckClosedCb(uv_handle_t* handle);
+~CheckWrap() = default;
+
+ Environment* env_;
+ CheckCb fn_;
+uv_check_t check_;
+
+friend std::unique_ptr<CheckWrap>::deleter_type;
+};
+
+classCheckWrapHandle : publicMemoryRetainer {
+public:
+template <typename... Args>
+explicitCheckWrapHandle(Environment* env, Args&&... args)
+ : check_(new CheckWrap(env, std::forward<Args>(args)...)) {
+ env->AddCleanupHook(CleanupHook, this);
+ }
+
+DISALLOW_COPY_AND_MOVE(CheckWrapHandle)
+
+~CheckWrapHandle() { Close(); }
+
+inlineoperatorbool() const { return check_ != nullptr; }
+
+voidStart();
+voidStop();
+voidClose();
+voidRef();
+voidUnref();
+
+voidMemoryInfo(node::MemoryTracker* tracker) constoverride;
+
+SET_MEMORY_INFO_NAME(CheckWrapHandle)
+SET_SELF_SIZE(CheckWrapHandle)
+
+private:
+staticvoidCleanupHook(void* data);
+ CheckWrap* check_;
+};
+
 // =============================================================================
 // The BindingState object holds state for the internalBinding('quic') binding
 // instance. It is mostly used to hold the persistent constructors, strings, and
@@ -271,16 +347,15 @@ class BindingData final
  ArenaPtr endpoint_state_arena_{nullptr, +[](void*) {}};
  ArenaPtr endpoint_stats_arena_{nullptr, +[](void*) {}};
 
-// Deferred send flush state. The uv_check_t fires immediately after
+// Deferred send flush state. The CheckWrapHandle fires immediately after
 // the I/O poll phase in the same event loop tick, allowing batched
 // receive processing: all packets are read during poll, then
 // SendPendingData is called once per dirty session in the check callback.
-uv_check_t flush_check_;
+CheckWrapHandle flush_check_;
  std::vector<BaseObjectPtr<Session>> pending_flush_sessions_;
 bool flush_check_started_ = false;
-bool flush_check_initialized_ = false;
 
-staticvoidOnFlushCheck(uv_check_t* handle);
+voidOnFlushCheck();
 };
 
 JS_METHOD_IMPL(IllegalConstructor);

src/quic/streams.cc

@@ -1563,8 +1563,11 @@ void Stream::Destroy(QuicError error) {
 auto session = session_;
  session_.reset();
 // EmitClose above triggers MakeCallback which can destroy the session
-// via JS re-entrancy. The weak pointer may now be null.
-if (session) session->RemoveStream(id());
+// via JS re-entrancy. The weak pointer may still be non-null (the
+// Session BaseObject can be kept alive by a BaseObjectPtr elsewhere,
+// e.g. OnTimeout's ref) even though impl_ has been reset. We must
+// check is_destroyed() to avoid dereferencing the null impl_.
+if (session && !session->is_destroyed()) session->RemoveStream(id());
 
 // Critically, make sure that the RemoveStream call is the last thing
 // trying to use this stream object. Once that call is made, the stream

src/quic/application.cc

@@ -369,7 +369,8 @@ void Session::Application::SendPendingData() {
 if (closed) return;
 // Flush any remaining accumulated packets before updating stats.
 flush_batch();
-if (session().is_destroyed()) [[unlikely]]return;
+if (session().is_destroyed()) [[unlikely]]
+return;
 
 // Get a strong pointer to protect against potential destruction during
 // updating the time and data stats.

src/quic/bindingdata.cc

@@ -149,21 +149,87 @@ void* Nghttp3Realloc(void* ptr, size_t size, void* ud) {
 }
 } // namespace
 
+// ============================================================================
+// CheckWrap / CheckWrapHandle
+
+voidCheckWrap::Start() {
+if (check_.data == nullptr) return;
+uv_check_start(&check_, OnCheck);
+}
+
+voidCheckWrap::Stop() {
+if (check_.data == nullptr) return;
+uv_check_stop(&check_);
+}
+
+voidCheckWrap::Close() {
+ check_.data = nullptr;
+ env_->CloseHandle(reinterpret_cast<uv_handle_t*>(&check_), CheckClosedCb);
+}
+
+voidCheckWrap::Ref() {
+if (check_.data == nullptr) return;
+uv_ref(reinterpret_cast<uv_handle_t*>(&check_));
+}
+
+voidCheckWrap::Unref() {
+if (check_.data == nullptr) return;
+uv_unref(reinterpret_cast<uv_handle_t*>(&check_));
+}
+
+voidCheckWrap::OnCheck(uv_check_t* check) {
+ CheckWrap* wrap = ContainerOf(&CheckWrap::check_, check);
+ wrap->fn_();
+}
+
+voidCheckWrap::CheckClosedCb(uv_handle_t* handle) {
+ std::unique_ptr<CheckWrap> ptr(
+ContainerOf(&CheckWrap::check_, reinterpret_cast<uv_check_t*>(handle)));
+}
+
+voidCheckWrapHandle::Start() {
+if (check_ != nullptr) check_->Start();
+}
+
+voidCheckWrapHandle::Stop() {
+if (check_ != nullptr) check_->Stop();
+}
+
+voidCheckWrapHandle::Close() {
+if (check_ != nullptr) {
+ check_->env()->RemoveCleanupHook(CleanupHook, this);
+ check_->Close();
+ }
+ check_ = nullptr;
+}
+
+voidCheckWrapHandle::Ref() {
+if (check_ != nullptr) check_->Ref();
+}
+
+voidCheckWrapHandle::Unref() {
+if (check_ != nullptr) check_->Unref();
+}
+
+voidCheckWrapHandle::MemoryInfo(MemoryTracker* tracker) const {
+if (check_ != nullptr) tracker->TrackField("check", *check_);
+}
+
+voidCheckWrapHandle::CleanupHook(void* data) {
+static_cast<CheckWrapHandle*>(data)->Close();
+}
+
+// ============================================================================
+
 BindingData& BindingData::Get(Environment* env) {
 return *(env->principal_realm()->GetBindingData<BindingData>());
 }
 
 BindingData::~BindingData() {
  quic_alloc_state.binding = nullptr;
-if (flush_check_initialized_) {
-uv_check_stop(&flush_check_);
- flush_check_started_ = false;
-// The check handle is closed inline here. Because BindingData destruction
-// happens during Environment cleanup, the handle will be finalized by
-// libuv's close phase.
-uv_close(reinterpret_cast<uv_handle_t*>(&flush_check_), nullptr);
- flush_check_initialized_ = false;
- }
+// flush_check_ is cleaned up by ~CheckWrapHandle() after the destructor
+// body completes. The inner CheckWrap (and its uv_check_t) will be freed
+// later by the uv_close callback, after CleanupHandles() runs uv_run().
  pending_flush_sessions_.clear();
 }
 
@@ -230,13 +296,11 @@ void BindingData::RegisterExternalReferences(
 }
 
 BindingData::BindingData(Realm* realm, Local<Object> object)
- : BaseObject(realm, object) {
+ : BaseObject(realm, object),
+flush_check_(env(), [this]() { OnFlushCheck(); }) {
 MakeWeak();
-CHECK_EQ(uv_check_init(env()->event_loop(), &flush_check_), 0);
- flush_check_.data = this;
 // Unref so the check handle doesn't keep the event loop alive on its own.
-uv_unref(reinterpret_cast<uv_handle_t*>(&flush_check_));
- flush_check_initialized_ = true;
+ flush_check_.Unref();
 }
 
 SessionManager& BindingData::session_manager() {
@@ -249,27 +313,26 @@ SessionManager& BindingData::session_manager() {
 voidBindingData::ScheduleSessionFlush(const BaseObjectPtr<Session>& session) {
  pending_flush_sessions_.push_back(session);
 if (!flush_check_started_) {
-uv_check_start(&flush_check_, OnFlushCheck);
+ flush_check_.Start();
  flush_check_started_ = true;
  }
 }
 
-voidBindingData::OnFlushCheck(uv_check_t* handle) {
-auto* binding = static_cast<BindingData*>(handle->data);
-if (binding->pending_flush_sessions_.empty()) {
-uv_check_stop(&binding->flush_check_);
- binding->flush_check_started_ = false;
+voidBindingData::OnFlushCheck() {
+if (pending_flush_sessions_.empty()) {
+ flush_check_.Stop();
+ flush_check_started_ = false;
 return;
  }
 
- HandleScope scope(binding->env()->isolate());
+ HandleScope scope(env()->isolate());
 
 // Swap to a local vector before iterating. SendPendingData may trigger
 // MakeCallback which runs JS that could cause more packet receives via
 // re-entry (e.g., a stream data callback that synchronously writes to
 // another session). Any sessions added during the flush remain in
 // pending_flush_sessions_ and are picked up on the next check tick.
-auto sessions = std::move(binding->pending_flush_sessions_);
+auto sessions = std::move(pending_flush_sessions_);
 for (auto& session : sessions) {
  session->pending_flush_ = false;
 if (!session->is_destroyed()) {
@@ -279,9 +342,9 @@ void BindingData::OnFlushCheck(uv_check_t* handle) {
 
 // If no new sessions were added during the flush, stop the check
 // to avoid per-tick callback overhead when idle.
-if (binding->pending_flush_sessions_.empty()) {
-uv_check_stop(&binding->flush_check_);
-binding->flush_check_started_ = false;
+if (pending_flush_sessions_.empty()) {
+ flush_check_.Stop();
+ flush_check_started_ = false;
  }
 }
 

src/quic/bindingdata.h

@@ -12,6 +12,7 @@
 #include<node_mem.h>
 #include<uv.h>
 #include<v8.h>
+#include<functional>
 #include<memory>
 #include<unordered_map>
 #include<vector>
@@ -157,6 +158,81 @@ class SessionManager;
 V(verify_private_key, "verifyPrivateKey") \
 V(version, "version")
 
+// =============================================================================
+// Lightweight wrappers around uv_check_t that ensure safe handle closure.
+// The check handle is embedded in a heap-allocated CheckWrap whose destruction
+// is deferred until the uv_close callback fires, preventing use-after-free
+// when the owning object is destroyed before libuv finishes closing the handle.
+// Follows the same two-layer pattern as TimerWrap / TimerWrapHandle
+// (see timer_wrap.h).
+// TODO(@jasnell): Consider moving it out to a separate file like timer_wrap.h.
+classCheckWrapfinal : public MemoryRetainer {
+public:
+using CheckCb = std::function<void()>;
+
+template <typename... Args>
+explicitCheckWrap(Environment* env, Args&&... args)
+ : env_(env), fn_(std::forward<Args>(args)...) {
+uv_check_init(env->event_loop(), &check_);
+ check_.data = this;
+ }
+
+DISALLOW_COPY_AND_MOVE(CheckWrap)
+
+inline Environment* env() const { return env_; }
+
+voidStart();
+voidStop();
+voidClose();
+voidRef();
+voidUnref();
+
+SET_NO_MEMORY_INFO()
+SET_MEMORY_INFO_NAME(CheckWrap)
+SET_SELF_SIZE(CheckWrap)
+
+private:
+staticvoidOnCheck(uv_check_t* check);
+staticvoidCheckClosedCb(uv_handle_t* handle);
+~CheckWrap() = default;
+
+ Environment* env_;
+ CheckCb fn_;
+uv_check_t check_;
+
+friend std::unique_ptr<CheckWrap>::deleter_type;
+};
+
+classCheckWrapHandle : publicMemoryRetainer {
+public:
+template <typename... Args>
+explicitCheckWrapHandle(Environment* env, Args&&... args)
+ : check_(new CheckWrap(env, std::forward<Args>(args)...)) {
+ env->AddCleanupHook(CleanupHook, this);
+ }
+
+DISALLOW_COPY_AND_MOVE(CheckWrapHandle)
+
+~CheckWrapHandle() { Close(); }
+
+inlineoperatorbool() const { return check_ != nullptr; }
+
+voidStart();
+voidStop();
+voidClose();
+voidRef();
+voidUnref();
+
+voidMemoryInfo(node::MemoryTracker* tracker) constoverride;
+
+SET_MEMORY_INFO_NAME(CheckWrapHandle)
+SET_SELF_SIZE(CheckWrapHandle)
+
+private:
+staticvoidCleanupHook(void* data);
+ CheckWrap* check_;
+};
+
 // =============================================================================
 // The BindingState object holds state for the internalBinding('quic') binding
 // instance. It is mostly used to hold the persistent constructors, strings, and
@@ -271,16 +347,15 @@ class BindingData final
  ArenaPtr endpoint_state_arena_{nullptr, +[](void*) {}};
  ArenaPtr endpoint_stats_arena_{nullptr, +[](void*) {}};
 
-// Deferred send flush state. The uv_check_t fires immediately after
+// Deferred send flush state. The CheckWrapHandle fires immediately after
 // the I/O poll phase in the same event loop tick, allowing batched
 // receive processing: all packets are read during poll, then
 // SendPendingData is called once per dirty session in the check callback.
-uv_check_t flush_check_;
+CheckWrapHandle flush_check_;
  std::vector<BaseObjectPtr<Session>> pending_flush_sessions_;
 bool flush_check_started_ = false;
-bool flush_check_initialized_ = false;
 
-staticvoidOnFlushCheck(uv_check_t* handle);
+voidOnFlushCheck();
 };
 
 JS_METHOD_IMPL(IllegalConstructor);

src/quic/streams.cc

@@ -1563,8 +1563,11 @@ void Stream::Destroy(QuicError error) {
 auto session = session_;
  session_.reset();
 // EmitClose above triggers MakeCallback which can destroy the session
-// via JS re-entrancy. The weak pointer may now be null.
-if (session) session->RemoveStream(id());
+// via JS re-entrancy. The weak pointer may still be non-null (the
+// Session BaseObject can be kept alive by a BaseObjectPtr elsewhere,
+// e.g. OnTimeout's ref) even though impl_ has been reset. We must
+// check is_destroyed() to avoid dereferencing the null impl_.
+if (session && !session->is_destroyed()) session->RemoveStream(id());
 
 // Critically, make sure that the RemoveStream call is the last thing
 // trying to use this stream object. Once that call is made, the stream

src/quic/application.cc

@@ -369,7 +369,8 @@ void Session::Application::SendPendingData() {
 if (closed) return;
 // Flush any remaining accumulated packets before updating stats.
 flush_batch();
-if (session().is_destroyed()) [[unlikely]]return;
+if (session().is_destroyed()) [[unlikely]]
+return;
 
 // Get a strong pointer to protect against potential destruction during
 // updating the time and data stats.

src/quic/bindingdata.cc

@@ -149,21 +149,87 @@ void* Nghttp3Realloc(void* ptr, size_t size, void* ud) {
 }
 } // namespace
 
+// ============================================================================
+// CheckWrap / CheckWrapHandle
+
+voidCheckWrap::Start() {
+if (check_.data == nullptr) return;
+uv_check_start(&check_, OnCheck);
+}
+
+voidCheckWrap::Stop() {
+if (check_.data == nullptr) return;
+uv_check_stop(&check_);
+}
+
+voidCheckWrap::Close() {
+ check_.data = nullptr;
+ env_->CloseHandle(reinterpret_cast<uv_handle_t*>(&check_), CheckClosedCb);
+}
+
+voidCheckWrap::Ref() {
+if (check_.data == nullptr) return;
+uv_ref(reinterpret_cast<uv_handle_t*>(&check_));
+}
+
+voidCheckWrap::Unref() {
+if (check_.data == nullptr) return;
+uv_unref(reinterpret_cast<uv_handle_t*>(&check_));
+}
+
+voidCheckWrap::OnCheck(uv_check_t* check) {
+ CheckWrap* wrap = ContainerOf(&CheckWrap::check_, check);
+ wrap->fn_();
+}
+
+voidCheckWrap::CheckClosedCb(uv_handle_t* handle) {
+ std::unique_ptr<CheckWrap> ptr(
+ContainerOf(&CheckWrap::check_, reinterpret_cast<uv_check_t*>(handle)));
+}
+
+voidCheckWrapHandle::Start() {
+if (check_ != nullptr) check_->Start();
+}
+
+voidCheckWrapHandle::Stop() {
+if (check_ != nullptr) check_->Stop();
+}
+
+voidCheckWrapHandle::Close() {
+if (check_ != nullptr) {
+ check_->env()->RemoveCleanupHook(CleanupHook, this);
+ check_->Close();
+ }
+ check_ = nullptr;
+}
+
+voidCheckWrapHandle::Ref() {
+if (check_ != nullptr) check_->Ref();
+}
+
+voidCheckWrapHandle::Unref() {
+if (check_ != nullptr) check_->Unref();
+}
+
+voidCheckWrapHandle::MemoryInfo(MemoryTracker* tracker) const {
+if (check_ != nullptr) tracker->TrackField("check", *check_);
+}
+
+voidCheckWrapHandle::CleanupHook(void* data) {
+static_cast<CheckWrapHandle*>(data)->Close();
+}
+
+// ============================================================================
+
 BindingData& BindingData::Get(Environment* env) {
 return *(env->principal_realm()->GetBindingData<BindingData>());
 }
 
 BindingData::~BindingData() {
  quic_alloc_state.binding = nullptr;
-if (flush_check_initialized_) {
-uv_check_stop(&flush_check_);
- flush_check_started_ = false;
-// The check handle is closed inline here. Because BindingData destruction
-// happens during Environment cleanup, the handle will be finalized by
-// libuv's close phase.
-uv_close(reinterpret_cast<uv_handle_t*>(&flush_check_), nullptr);
- flush_check_initialized_ = false;
- }
+// flush_check_ is cleaned up by ~CheckWrapHandle() after the destructor
+// body completes. The inner CheckWrap (and its uv_check_t) will be freed
+// later by the uv_close callback, after CleanupHandles() runs uv_run().
  pending_flush_sessions_.clear();
 }
 
@@ -230,13 +296,11 @@ void BindingData::RegisterExternalReferences(
 }
 
 BindingData::BindingData(Realm* realm, Local<Object> object)
- : BaseObject(realm, object) {
+ : BaseObject(realm, object),
+flush_check_(env(), [this]() { OnFlushCheck(); }) {
 MakeWeak();
-CHECK_EQ(uv_check_init(env()->event_loop(), &flush_check_), 0);
- flush_check_.data = this;
 // Unref so the check handle doesn't keep the event loop alive on its own.
-uv_unref(reinterpret_cast<uv_handle_t*>(&flush_check_));
- flush_check_initialized_ = true;
+ flush_check_.Unref();
 }
 
 SessionManager& BindingData::session_manager() {
@@ -249,27 +313,26 @@ SessionManager& BindingData::session_manager() {
 voidBindingData::ScheduleSessionFlush(const BaseObjectPtr<Session>& session) {
  pending_flush_sessions_.push_back(session);
 if (!flush_check_started_) {
-uv_check_start(&flush_check_, OnFlushCheck);
+ flush_check_.Start();
  flush_check_started_ = true;
  }
 }
 
-voidBindingData::OnFlushCheck(uv_check_t* handle) {
-auto* binding = static_cast<BindingData*>(handle->data);
-if (binding->pending_flush_sessions_.empty()) {
-uv_check_stop(&binding->flush_check_);
- binding->flush_check_started_ = false;
+voidBindingData::OnFlushCheck() {
+if (pending_flush_sessions_.empty()) {
+ flush_check_.Stop();
+ flush_check_started_ = false;
 return;
  }
 
- HandleScope scope(binding->env()->isolate());
+ HandleScope scope(env()->isolate());
 
 // Swap to a local vector before iterating. SendPendingData may trigger
 // MakeCallback which runs JS that could cause more packet receives via
 // re-entry (e.g., a stream data callback that synchronously writes to
 // another session). Any sessions added during the flush remain in
 // pending_flush_sessions_ and are picked up on the next check tick.
-auto sessions = std::move(binding->pending_flush_sessions_);
+auto sessions = std::move(pending_flush_sessions_);
 for (auto& session : sessions) {
  session->pending_flush_ = false;
 if (!session->is_destroyed()) {
@@ -279,9 +342,9 @@ void BindingData::OnFlushCheck(uv_check_t* handle) {
 
 // If no new sessions were added during the flush, stop the check
 // to avoid per-tick callback overhead when idle.
-if (binding->pending_flush_sessions_.empty()) {
-uv_check_stop(&binding->flush_check_);
-binding->flush_check_started_ = false;
+if (pending_flush_sessions_.empty()) {
+ flush_check_.Stop();
+ flush_check_started_ = false;
  }
 }
 

src/quic/bindingdata.h

@@ -12,6 +12,7 @@
 #include<node_mem.h>
 #include<uv.h>
 #include<v8.h>
+#include<functional>
 #include<memory>
 #include<unordered_map>
 #include<vector>
@@ -157,6 +158,81 @@ class SessionManager;
 V(verify_private_key, "verifyPrivateKey") \
 V(version, "version")
 
+// =============================================================================
+// Lightweight wrappers around uv_check_t that ensure safe handle closure.
+// The check handle is embedded in a heap-allocated CheckWrap whose destruction
+// is deferred until the uv_close callback fires, preventing use-after-free
+// when the owning object is destroyed before libuv finishes closing the handle.
+// Follows the same two-layer pattern as TimerWrap / TimerWrapHandle
+// (see timer_wrap.h).
+// TODO(@jasnell): Consider moving it out to a separate file like timer_wrap.h.
+classCheckWrapfinal : public MemoryRetainer {
+public:
+using CheckCb = std::function<void()>;
+
+template <typename... Args>
+explicitCheckWrap(Environment* env, Args&&... args)
+ : env_(env), fn_(std::forward<Args>(args)...) {
+uv_check_init(env->event_loop(), &check_);
+ check_.data = this;
+ }
+
+DISALLOW_COPY_AND_MOVE(CheckWrap)
+
+inline Environment* env() const { return env_; }
+
+voidStart();
+voidStop();
+voidClose();
+voidRef();
+voidUnref();
+
+SET_NO_MEMORY_INFO()
+SET_MEMORY_INFO_NAME(CheckWrap)
+SET_SELF_SIZE(CheckWrap)
+
+private:
+staticvoidOnCheck(uv_check_t* check);
+staticvoidCheckClosedCb(uv_handle_t* handle);
+~CheckWrap() = default;
+
+ Environment* env_;
+ CheckCb fn_;
+uv_check_t check_;
+
+friend std::unique_ptr<CheckWrap>::deleter_type;
+};
+
+classCheckWrapHandle : publicMemoryRetainer {
+public:
+template <typename... Args>
+explicitCheckWrapHandle(Environment* env, Args&&... args)
+ : check_(new CheckWrap(env, std::forward<Args>(args)...)) {
+ env->AddCleanupHook(CleanupHook, this);
+ }
+
+DISALLOW_COPY_AND_MOVE(CheckWrapHandle)
+
+~CheckWrapHandle() { Close(); }
+
+inlineoperatorbool() const { return check_ != nullptr; }
+
+voidStart();
+voidStop();
+voidClose();
+voidRef();
+voidUnref();
+
+voidMemoryInfo(node::MemoryTracker* tracker) constoverride;
+
+SET_MEMORY_INFO_NAME(CheckWrapHandle)
+SET_SELF_SIZE(CheckWrapHandle)
+
+private:
+staticvoidCleanupHook(void* data);
+ CheckWrap* check_;
+};
+
 // =============================================================================
 // The BindingState object holds state for the internalBinding('quic') binding
 // instance. It is mostly used to hold the persistent constructors, strings, and
@@ -271,16 +347,15 @@ class BindingData final
  ArenaPtr endpoint_state_arena_{nullptr, +[](void*) {}};
  ArenaPtr endpoint_stats_arena_{nullptr, +[](void*) {}};
 
-// Deferred send flush state. The uv_check_t fires immediately after
+// Deferred send flush state. The CheckWrapHandle fires immediately after
 // the I/O poll phase in the same event loop tick, allowing batched
 // receive processing: all packets are read during poll, then
 // SendPendingData is called once per dirty session in the check callback.
-uv_check_t flush_check_;
+CheckWrapHandle flush_check_;
  std::vector<BaseObjectPtr<Session>> pending_flush_sessions_;
 bool flush_check_started_ = false;
-bool flush_check_initialized_ = false;
 
-staticvoidOnFlushCheck(uv_check_t* handle);
+voidOnFlushCheck();
 };
 
 JS_METHOD_IMPL(IllegalConstructor);

src/quic/streams.cc

@@ -1563,8 +1563,11 @@ void Stream::Destroy(QuicError error) {
 auto session = session_;
  session_.reset();
 // EmitClose above triggers MakeCallback which can destroy the session
-// via JS re-entrancy. The weak pointer may now be null.
-if (session) session->RemoveStream(id());
+// via JS re-entrancy. The weak pointer may still be non-null (the
+// Session BaseObject can be kept alive by a BaseObjectPtr elsewhere,
+// e.g. OnTimeout's ref) even though impl_ has been reset. We must
+// check is_destroyed() to avoid dereferencing the null impl_.
+if (session && !session->is_destroyed()) session->RemoveStream(id());
 
 // Critically, make sure that the RemoveStream call is the last thing
 // trying to use this stream object. Once that call is made, the stream

src/quic/application.cc

@@ -369,7 +369,8 @@ void Session::Application::SendPendingData() {
 if (closed) return;
 // Flush any remaining accumulated packets before updating stats.
 flush_batch();
-if (session().is_destroyed()) [[unlikely]]return;
+if (session().is_destroyed()) [[unlikely]]
+return;
 
 // Get a strong pointer to protect against potential destruction during
 // updating the time and data stats.

src/quic/bindingdata.cc

@@ -149,21 +149,87 @@ void* Nghttp3Realloc(void* ptr, size_t size, void* ud) {
 }
 } // namespace
 
+// ============================================================================
+// CheckWrap / CheckWrapHandle
+
+voidCheckWrap::Start() {
+if (check_.data == nullptr) return;
+uv_check_start(&check_, OnCheck);
+}
+
+voidCheckWrap::Stop() {
+if (check_.data == nullptr) return;
+uv_check_stop(&check_);
+}
+
+voidCheckWrap::Close() {
+ check_.data = nullptr;
+ env_->CloseHandle(reinterpret_cast<uv_handle_t*>(&check_), CheckClosedCb);
+}
+
+voidCheckWrap::Ref() {
+if (check_.data == nullptr) return;
+uv_ref(reinterpret_cast<uv_handle_t*>(&check_));
+}
+
+voidCheckWrap::Unref() {
+if (check_.data == nullptr) return;
+uv_unref(reinterpret_cast<uv_handle_t*>(&check_));
+}
+
+voidCheckWrap::OnCheck(uv_check_t* check) {
+ CheckWrap* wrap = ContainerOf(&CheckWrap::check_, check);
+ wrap->fn_();
+}
+
+voidCheckWrap::CheckClosedCb(uv_handle_t* handle) {
+ std::unique_ptr<CheckWrap> ptr(
+ContainerOf(&CheckWrap::check_, reinterpret_cast<uv_check_t*>(handle)));
+}
+
+voidCheckWrapHandle::Start() {
+if (check_ != nullptr) check_->Start();
+}
+
+voidCheckWrapHandle::Stop() {
+if (check_ != nullptr) check_->Stop();
+}
+
+voidCheckWrapHandle::Close() {
+if (check_ != nullptr) {
+ check_->env()->RemoveCleanupHook(CleanupHook, this);
+ check_->Close();
+ }
+ check_ = nullptr;
+}
+
+voidCheckWrapHandle::Ref() {
+if (check_ != nullptr) check_->Ref();
+}
+
+voidCheckWrapHandle::Unref() {
+if (check_ != nullptr) check_->Unref();
+}
+
+voidCheckWrapHandle::MemoryInfo(MemoryTracker* tracker) const {
+if (check_ != nullptr) tracker->TrackField("check", *check_);
+}
+
+voidCheckWrapHandle::CleanupHook(void* data) {
+static_cast<CheckWrapHandle*>(data)->Close();
+}
+
+// ============================================================================
+
 BindingData& BindingData::Get(Environment* env) {
 return *(env->principal_realm()->GetBindingData<BindingData>());
 }
 
 BindingData::~BindingData() {
  quic_alloc_state.binding = nullptr;
-if (flush_check_initialized_) {
-uv_check_stop(&flush_check_);
- flush_check_started_ = false;
-// The check handle is closed inline here. Because BindingData destruction
-// happens during Environment cleanup, the handle will be finalized by
-// libuv's close phase.
-uv_close(reinterpret_cast<uv_handle_t*>(&flush_check_), nullptr);
- flush_check_initialized_ = false;
- }
+// flush_check_ is cleaned up by ~CheckWrapHandle() after the destructor
+// body completes. The inner CheckWrap (and its uv_check_t) will be freed
+// later by the uv_close callback, after CleanupHandles() runs uv_run().
  pending_flush_sessions_.clear();
 }
 
@@ -230,13 +296,11 @@ void BindingData::RegisterExternalReferences(
 }
 
 BindingData::BindingData(Realm* realm, Local<Object> object)
- : BaseObject(realm, object) {
+ : BaseObject(realm, object),
+flush_check_(env(), [this]() { OnFlushCheck(); }) {
 MakeWeak();
-CHECK_EQ(uv_check_init(env()->event_loop(), &flush_check_), 0);
- flush_check_.data = this;
 // Unref so the check handle doesn't keep the event loop alive on its own.
-uv_unref(reinterpret_cast<uv_handle_t*>(&flush_check_));
- flush_check_initialized_ = true;
+ flush_check_.Unref();
 }
 
 SessionManager& BindingData::session_manager() {
@@ -249,27 +313,26 @@ SessionManager& BindingData::session_manager() {
 voidBindingData::ScheduleSessionFlush(const BaseObjectPtr<Session>& session) {
  pending_flush_sessions_.push_back(session);
 if (!flush_check_started_) {
-uv_check_start(&flush_check_, OnFlushCheck);
+ flush_check_.Start();
  flush_check_started_ = true;
  }
 }
 
-voidBindingData::OnFlushCheck(uv_check_t* handle) {
-auto* binding = static_cast<BindingData*>(handle->data);
-if (binding->pending_flush_sessions_.empty()) {
-uv_check_stop(&binding->flush_check_);
- binding->flush_check_started_ = false;
+voidBindingData::OnFlushCheck() {
+if (pending_flush_sessions_.empty()) {
+ flush_check_.Stop();
+ flush_check_started_ = false;
 return;
  }
 
- HandleScope scope(binding->env()->isolate());
+ HandleScope scope(env()->isolate());
 
 // Swap to a local vector before iterating. SendPendingData may trigger
 // MakeCallback which runs JS that could cause more packet receives via
 // re-entry (e.g., a stream data callback that synchronously writes to
 // another session). Any sessions added during the flush remain in
 // pending_flush_sessions_ and are picked up on the next check tick.
-auto sessions = std::move(binding->pending_flush_sessions_);
+auto sessions = std::move(pending_flush_sessions_);
 for (auto& session : sessions) {
  session->pending_flush_ = false;
 if (!session->is_destroyed()) {
@@ -279,9 +342,9 @@ void BindingData::OnFlushCheck(uv_check_t* handle) {
 
 // If no new sessions were added during the flush, stop the check
 // to avoid per-tick callback overhead when idle.
-if (binding->pending_flush_sessions_.empty()) {
-uv_check_stop(&binding->flush_check_);
-binding->flush_check_started_ = false;
+if (pending_flush_sessions_.empty()) {
+ flush_check_.Stop();
+ flush_check_started_ = false;
  }
 }
 

src/quic/bindingdata.h

@@ -12,6 +12,7 @@
 #include<node_mem.h>
 #include<uv.h>
 #include<v8.h>
+#include<functional>
 #include<memory>
 #include<unordered_map>
 #include<vector>
@@ -157,6 +158,81 @@ class SessionManager;
 V(verify_private_key, "verifyPrivateKey") \
 V(version, "version")
 
+// =============================================================================
+// Lightweight wrappers around uv_check_t that ensure safe handle closure.
+// The check handle is embedded in a heap-allocated CheckWrap whose destruction
+// is deferred until the uv_close callback fires, preventing use-after-free
+// when the owning object is destroyed before libuv finishes closing the handle.
+// Follows the same two-layer pattern as TimerWrap / TimerWrapHandle
+// (see timer_wrap.h).
+// TODO(@jasnell): Consider moving it out to a separate file like timer_wrap.h.
+classCheckWrapfinal : public MemoryRetainer {
+public:
+using CheckCb = std::function<void()>;
+
+template <typename... Args>
+explicitCheckWrap(Environment* env, Args&&... args)
+ : env_(env), fn_(std::forward<Args>(args)...) {
+uv_check_init(env->event_loop(), &check_);
+ check_.data = this;
+ }
+
+DISALLOW_COPY_AND_MOVE(CheckWrap)
+
+inline Environment* env() const { return env_; }
+
+voidStart();
+voidStop();
+voidClose();
+voidRef();
+voidUnref();
+
+SET_NO_MEMORY_INFO()
+SET_MEMORY_INFO_NAME(CheckWrap)
+SET_SELF_SIZE(CheckWrap)
+
+private:
+staticvoidOnCheck(uv_check_t* check);
+staticvoidCheckClosedCb(uv_handle_t* handle);
+~CheckWrap() = default;
+
+ Environment* env_;
+ CheckCb fn_;
+uv_check_t check_;
+
+friend std::unique_ptr<CheckWrap>::deleter_type;
+};
+
+classCheckWrapHandle : publicMemoryRetainer {
+public:
+template <typename... Args>
+explicitCheckWrapHandle(Environment* env, Args&&... args)
+ : check_(new CheckWrap(env, std::forward<Args>(args)...)) {
+ env->AddCleanupHook(CleanupHook, this);
+ }
+
+DISALLOW_COPY_AND_MOVE(CheckWrapHandle)
+
+~CheckWrapHandle() { Close(); }
+
+inlineoperatorbool() const { return check_ != nullptr; }
+
+voidStart();
+voidStop();
+voidClose();
+voidRef();
+voidUnref();
+
+voidMemoryInfo(node::MemoryTracker* tracker) constoverride;
+
+SET_MEMORY_INFO_NAME(CheckWrapHandle)
+SET_SELF_SIZE(CheckWrapHandle)
+
+private:
+staticvoidCleanupHook(void* data);
+ CheckWrap* check_;
+};
+
 // =============================================================================
 // The BindingState object holds state for the internalBinding('quic') binding
 // instance. It is mostly used to hold the persistent constructors, strings, and
@@ -271,16 +347,15 @@ class BindingData final
  ArenaPtr endpoint_state_arena_{nullptr, +[](void*) {}};
  ArenaPtr endpoint_stats_arena_{nullptr, +[](void*) {}};
 
-// Deferred send flush state. The uv_check_t fires immediately after
+// Deferred send flush state. The CheckWrapHandle fires immediately after
 // the I/O poll phase in the same event loop tick, allowing batched
 // receive processing: all packets are read during poll, then
 // SendPendingData is called once per dirty session in the check callback.
-uv_check_t flush_check_;
+CheckWrapHandle flush_check_;
  std::vector<BaseObjectPtr<Session>> pending_flush_sessions_;
 bool flush_check_started_ = false;
-bool flush_check_initialized_ = false;
 
-staticvoidOnFlushCheck(uv_check_t* handle);
+voidOnFlushCheck();
 };
 
 JS_METHOD_IMPL(IllegalConstructor);

src/quic/streams.cc

@@ -1563,8 +1563,11 @@ void Stream::Destroy(QuicError error) {
 auto session = session_;
  session_.reset();
 // EmitClose above triggers MakeCallback which can destroy the session
-// via JS re-entrancy. The weak pointer may now be null.
-if (session) session->RemoveStream(id());
+// via JS re-entrancy. The weak pointer may still be non-null (the
+// Session BaseObject can be kept alive by a BaseObjectPtr elsewhere,
+// e.g. OnTimeout's ref) even though impl_ has been reset. We must
+// check is_destroyed() to avoid dereferencing the null impl_.
+if (session && !session->is_destroyed()) session->RemoveStream(id());
 
 // Critically, make sure that the RemoveStream call is the last thing
 // trying to use this stream object. Once that call is made, the stream

src/quic/application.cc

@@ -369,7 +369,8 @@ void Session::Application::SendPendingData() {
 if (closed) return;
 // Flush any remaining accumulated packets before updating stats.
 flush_batch();
-if (session().is_destroyed()) [[unlikely]]return;
+if (session().is_destroyed()) [[unlikely]]
+return;
 
 // Get a strong pointer to protect against potential destruction during
 // updating the time and data stats.

src/quic/bindingdata.cc

@@ -149,21 +149,87 @@ void* Nghttp3Realloc(void* ptr, size_t size, void* ud) {
 }
 } // namespace
 
+// ============================================================================
+// CheckWrap / CheckWrapHandle
+
+voidCheckWrap::Start() {
+if (check_.data == nullptr) return;
+uv_check_start(&check_, OnCheck);
+}
+
+voidCheckWrap::Stop() {
+if (check_.data == nullptr) return;
+uv_check_stop(&check_);
+}
+
+voidCheckWrap::Close() {
+ check_.data = nullptr;
+ env_->CloseHandle(reinterpret_cast<uv_handle_t*>(&check_), CheckClosedCb);
+}
+
+voidCheckWrap::Ref() {
+if (check_.data == nullptr) return;
+uv_ref(reinterpret_cast<uv_handle_t*>(&check_));
+}
+
+voidCheckWrap::Unref() {
+if (check_.data == nullptr) return;
+uv_unref(reinterpret_cast<uv_handle_t*>(&check_));
+}
+
+voidCheckWrap::OnCheck(uv_check_t* check) {
+ CheckWrap* wrap = ContainerOf(&CheckWrap::check_, check);
+ wrap->fn_();
+}
+
+voidCheckWrap::CheckClosedCb(uv_handle_t* handle) {
+ std::unique_ptr<CheckWrap> ptr(
+ContainerOf(&CheckWrap::check_, reinterpret_cast<uv_check_t*>(handle)));
+}
+
+voidCheckWrapHandle::Start() {
+if (check_ != nullptr) check_->Start();
+}
+
+voidCheckWrapHandle::Stop() {
+if (check_ != nullptr) check_->Stop();
+}
+
+voidCheckWrapHandle::Close() {
+if (check_ != nullptr) {
+ check_->env()->RemoveCleanupHook(CleanupHook, this);
+ check_->Close();
+ }
+ check_ = nullptr;
+}
+
+voidCheckWrapHandle::Ref() {
+if (check_ != nullptr) check_->Ref();
+}
+
+voidCheckWrapHandle::Unref() {
+if (check_ != nullptr) check_->Unref();
+}
+
+voidCheckWrapHandle::MemoryInfo(MemoryTracker* tracker) const {
+if (check_ != nullptr) tracker->TrackField("check", *check_);
+}
+
+voidCheckWrapHandle::CleanupHook(void* data) {
+static_cast<CheckWrapHandle*>(data)->Close();
+}
+
+// ============================================================================
+
 BindingData& BindingData::Get(Environment* env) {
 return *(env->principal_realm()->GetBindingData<BindingData>());
 }
 
 BindingData::~BindingData() {
  quic_alloc_state.binding = nullptr;
-if (flush_check_initialized_) {
-uv_check_stop(&flush_check_);
- flush_check_started_ = false;
-// The check handle is closed inline here. Because BindingData destruction
-// happens during Environment cleanup, the handle will be finalized by
-// libuv's close phase.
-uv_close(reinterpret_cast<uv_handle_t*>(&flush_check_), nullptr);
- flush_check_initialized_ = false;
- }
+// flush_check_ is cleaned up by ~CheckWrapHandle() after the destructor
+// body completes. The inner CheckWrap (and its uv_check_t) will be freed
+// later by the uv_close callback, after CleanupHandles() runs uv_run().
  pending_flush_sessions_.clear();
 }
 
@@ -230,13 +296,11 @@ void BindingData::RegisterExternalReferences(
 }
 
 BindingData::BindingData(Realm* realm, Local<Object> object)
- : BaseObject(realm, object) {
+ : BaseObject(realm, object),
+flush_check_(env(), [this]() { OnFlushCheck(); }) {
 MakeWeak();
-CHECK_EQ(uv_check_init(env()->event_loop(), &flush_check_), 0);
- flush_check_.data = this;
 // Unref so the check handle doesn't keep the event loop alive on its own.
-uv_unref(reinterpret_cast<uv_handle_t*>(&flush_check_));
- flush_check_initialized_ = true;
+ flush_check_.Unref();
 }
 
 SessionManager& BindingData::session_manager() {
@@ -249,27 +313,26 @@ SessionManager& BindingData::session_manager() {
 voidBindingData::ScheduleSessionFlush(const BaseObjectPtr<Session>& session) {
  pending_flush_sessions_.push_back(session);
 if (!flush_check_started_) {
-uv_check_start(&flush_check_, OnFlushCheck);
+ flush_check_.Start();
  flush_check_started_ = true;
  }
 }
 
-voidBindingData::OnFlushCheck(uv_check_t* handle) {
-auto* binding = static_cast<BindingData*>(handle->data);
-if (binding->pending_flush_sessions_.empty()) {
-uv_check_stop(&binding->flush_check_);
- binding->flush_check_started_ = false;
+voidBindingData::OnFlushCheck() {
+if (pending_flush_sessions_.empty()) {
+ flush_check_.Stop();
+ flush_check_started_ = false;
 return;
  }
 
- HandleScope scope(binding->env()->isolate());
+ HandleScope scope(env()->isolate());
 
 // Swap to a local vector before iterating. SendPendingData may trigger
 // MakeCallback which runs JS that could cause more packet receives via
 // re-entry (e.g., a stream data callback that synchronously writes to
 // another session). Any sessions added during the flush remain in
 // pending_flush_sessions_ and are picked up on the next check tick.
-auto sessions = std::move(binding->pending_flush_sessions_);
+auto sessions = std::move(pending_flush_sessions_);
 for (auto& session : sessions) {
  session->pending_flush_ = false;
 if (!session->is_destroyed()) {
@@ -279,9 +342,9 @@ void BindingData::OnFlushCheck(uv_check_t* handle) {
 
 // If no new sessions were added during the flush, stop the check
 // to avoid per-tick callback overhead when idle.
-if (binding->pending_flush_sessions_.empty()) {
-uv_check_stop(&binding->flush_check_);
-binding->flush_check_started_ = false;
+if (pending_flush_sessions_.empty()) {
+ flush_check_.Stop();
+ flush_check_started_ = false;
  }
 }
 

src/quic/bindingdata.h

@@ -12,6 +12,7 @@
 #include<node_mem.h>
 #include<uv.h>
 #include<v8.h>
+#include<functional>
 #include<memory>
 #include<unordered_map>
 #include<vector>
@@ -157,6 +158,81 @@ class SessionManager;
 V(verify_private_key, "verifyPrivateKey") \
 V(version, "version")
 
+// =============================================================================
+// Lightweight wrappers around uv_check_t that ensure safe handle closure.
+// The check handle is embedded in a heap-allocated CheckWrap whose destruction
+// is deferred until the uv_close callback fires, preventing use-after-free
+// when the owning object is destroyed before libuv finishes closing the handle.
+// Follows the same two-layer pattern as TimerWrap / TimerWrapHandle
+// (see timer_wrap.h).
+// TODO(@jasnell): Consider moving it out to a separate file like timer_wrap.h.
+classCheckWrapfinal : public MemoryRetainer {
+public:
+using CheckCb = std::function<void()>;
+
+template <typename... Args>
+explicitCheckWrap(Environment* env, Args&&... args)
+ : env_(env), fn_(std::forward<Args>(args)...) {
+uv_check_init(env->event_loop(), &check_);
+ check_.data = this;
+ }
+
+DISALLOW_COPY_AND_MOVE(CheckWrap)
+
+inline Environment* env() const { return env_; }
+
+voidStart();
+voidStop();
+voidClose();
+voidRef();
+voidUnref();
+
+SET_NO_MEMORY_INFO()
+SET_MEMORY_INFO_NAME(CheckWrap)
+SET_SELF_SIZE(CheckWrap)
+
+private:
+staticvoidOnCheck(uv_check_t* check);
+staticvoidCheckClosedCb(uv_handle_t* handle);
+~CheckWrap() = default;
+
+ Environment* env_;
+ CheckCb fn_;
+uv_check_t check_;
+
+friend std::unique_ptr<CheckWrap>::deleter_type;
+};
+
+classCheckWrapHandle : publicMemoryRetainer {
+public:
+template <typename... Args>
+explicitCheckWrapHandle(Environment* env, Args&&... args)
+ : check_(new CheckWrap(env, std::forward<Args>(args)...)) {
+ env->AddCleanupHook(CleanupHook, this);
+ }
+
+DISALLOW_COPY_AND_MOVE(CheckWrapHandle)
+
+~CheckWrapHandle() { Close(); }
+
+inlineoperatorbool() const { return check_ != nullptr; }
+
+voidStart();
+voidStop();
+voidClose();
+voidRef();
+voidUnref();
+
+voidMemoryInfo(node::MemoryTracker* tracker) constoverride;
+
+SET_MEMORY_INFO_NAME(CheckWrapHandle)
+SET_SELF_SIZE(CheckWrapHandle)
+
+private:
+staticvoidCleanupHook(void* data);
+ CheckWrap* check_;
+};
+
 // =============================================================================
 // The BindingState object holds state for the internalBinding('quic') binding
 // instance. It is mostly used to hold the persistent constructors, strings, and
@@ -271,16 +347,15 @@ class BindingData final
  ArenaPtr endpoint_state_arena_{nullptr, +[](void*) {}};
  ArenaPtr endpoint_stats_arena_{nullptr, +[](void*) {}};
 
-// Deferred send flush state. The uv_check_t fires immediately after
+// Deferred send flush state. The CheckWrapHandle fires immediately after
 // the I/O poll phase in the same event loop tick, allowing batched
 // receive processing: all packets are read during poll, then
 // SendPendingData is called once per dirty session in the check callback.
-uv_check_t flush_check_;
+CheckWrapHandle flush_check_;
  std::vector<BaseObjectPtr<Session>> pending_flush_sessions_;
 bool flush_check_started_ = false;
-bool flush_check_initialized_ = false;
 
-staticvoidOnFlushCheck(uv_check_t* handle);
+voidOnFlushCheck();
 };
 
 JS_METHOD_IMPL(IllegalConstructor);

src/quic/streams.cc

@@ -1563,8 +1563,11 @@ void Stream::Destroy(QuicError error) {
 auto session = session_;
  session_.reset();
 // EmitClose above triggers MakeCallback which can destroy the session
-// via JS re-entrancy. The weak pointer may now be null.
-if (session) session->RemoveStream(id());
+// via JS re-entrancy. The weak pointer may still be non-null (the
+// Session BaseObject can be kept alive by a BaseObjectPtr elsewhere,
+// e.g. OnTimeout's ref) even though impl_ has been reset. We must
+// check is_destroyed() to avoid dereferencing the null impl_.
+if (session && !session->is_destroyed()) session->RemoveStream(id());
 
 // Critically, make sure that the RemoveStream call is the last thing
 // trying to use this stream object. Once that call is made, the stream