vfs: prevent stack overflow in recursive readdir on circular symlinks by AkshatOP · Pull Request #64149 · nodejs/node

AkshatOP · 2026-06-26T12:42:37Z

MemoryProvider#readdirSync with recursive: true follows symlinks to directories during traversal but did not bound the number of symlinks followed along a branch. A circular symlink therefore caused unbounded recursion in the internal walk() helper until the call stack was exhausted, crashing the process with RangeError: Maximum call stack size exceeded. Both the synchronous and promise-based variants were affected. The existing kMaxSymlinkDepth guard in #lookupEntry did not help, because walk() resolved each symlink target with a fresh depth of zero.

Track the number of symlink hops along the current branch and stop recursing once it would exceed kMaxSymlinkDepth, mirroring the ELOOP guard in #lookupEntry and the behavior of the real filesystem, which follows directory symlinks until the OS symlink limit is reached. The entries themselves are still listed, so non-circular symlinks continue to be followed as before.

Fixes: #64148

jasnell · 2026-06-27T02:33:40Z

@@ -612,7 +612,7 @@ class MemoryProvider extends VirtualProvider {
 #readdirRecursive(dirEntry, dirPath, withFileTypes) {
 const results = [];

- const walk = (entry, currentPath, relativePath) => {
+ const walk = (entry, currentPath, relativePath, symlinkDepth) => {


Instead of keeping this recursive, can it be refactored to be iterative to avoid the risk entirely?

alrightt... I switched #readdirRecursive to an iterative traversal with an explicit queue (same shape as fs.readdirSyncRecursive), so neither circular symlinks nor deeply nested trees can blow the call stack now.
I kept a per-entry symlink-hop counter bounded by kMaxSymlinkDepth, since the walk still follows directory symlinks and a cycle would otherwise grow the queue without end. It stops at the same point the real FS does (ELOOP) — the self-referential PoC returns the same 42 entries as fs.readdirSync(path, { recursive: true }). I went with the depth bound over a visited set to keep the output in parity with real fs, but happy to switch if you'd rather.

jojin1709 · 2026-06-27T10:48:47Z

Thanks for the fix! I can confirm the iterative approach is the right call —
avoids both the stack overflow and keeps output parity with real fs.
The queue-based traversal with symlink depth bound is clean.

AkshatOP · 2026-06-29T18:34:46Z

friendly ping! anything else you'd like changed here?
@jasnell

MemoryProvider recursive readdir walked the directory tree with a recursive helper. Rewrite it to traverse iteratively with an explicit stack so a deeply nested tree can no longer exhaust the call stack. The set of directories on the active traversal path is still tracked, so a circular symlink stops descending while its entry remains listed; the output and observable behavior are unchanged. Refs: nodejs#64168 Signed-off-by: AkshatOP <hunterdevil0987@gmail.com>

AkshatOP · 2026-07-05T06:49:48Z

Updated this PR per @jasnell's preference for an iterative walk (raised here and on #64168: "I'd much prefer to see if there's a way to make the walk iterative rather than recursive").

It's now a pure recursive→iterative refactor on top of the landed #64168 , #readdirRecursive uses an explicit stack, so deeply nested trees can't exhaust the call stack. The active-path cycle handling is unchanged, so all the tests from #64168 pass as-is and the output is identical (the self-referential symlink still returns ['dir','dir/loop','dir/nested.txt']). No behavior change, just no recursion. Happy to adjust anything.

jasnell · 2026-07-07T03:27:47Z

@mcollina ... can you take a look?

mcollina

lgtm

mcollina

Can you add a test?

AkshatOP · 2026-07-07T15:57:47Z

@mcollina Added the test

mcollina

lgtm

codecov · 2026-07-09T21:36:00Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.23%. Comparing base (b59def5) to head (b0e0986).
⚠️ Report is 152 commits behind head on main.

Additional details and impacted files

@@ Coverage Diff @@## main #64149 +/- ##
==========================================
- Coverage 92.04% 90.23% -1.82% 
==========================================
Files 381 741 +360 Lines 169293 240991 +71698 Branches 25948 45401 +19453 ==========================================
+ Hits 155826 217451 +61625 - Misses 13177 15111 +1934 - Partials 290 8429 +8139

Files with missing lines	Coverage Δ
lib/internal/vfs/providers/memory.js	`95.06% <100.00%> (+0.48%)`	⬆️

... and 495 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-07-10T04:08:04Z

CI: https://ci.nodejs.org/job/node-test-pull-request/74715/

AkshatOP · 2026-07-14T20:23:05Z

didn't mean to ping but i don't know the process after this , is this approved for a merge or do it need changes

nodejs-github-bot · 2026-07-21T06:37:43Z

Landed in 4bec191

MemoryProvider recursive readdir walked the directory tree with a recursive helper. Rewrite it to traverse iteratively with an explicit stack so a deeply nested tree can no longer exhaust the call stack. The set of directories on the active traversal path is still tracked, so a circular symlink stops descending while its entry remains listed; the output and observable behavior are unchanged. Refs: #64168 Signed-off-by: AkshatOP <hunterdevil0987@gmail.com> PR-URL: #64149Fixes: #64148 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

nodejs-github-bot added needs-ci PRs that need a full CI run. vfs Issues and PRs related to the virtual filesystem subsystem. labels Jun 26, 2026

jasnell reviewed Jun 27, 2026
View reviewed changes

AkshatOP force-pushed the fix-vfs-readdir-circular-symlink branch from 62229c0 to 2e4e1beCompare June 27, 2026 03:56

AkshatOP requested a review from jasnell June 29, 2026 18:35

jasnell approved these changes Jul 4, 2026
View reviewed changes

AkshatOP force-pushed the fix-vfs-readdir-circular-symlink branch from 2e4e1be to 56ef7a4Compare July 5, 2026 06:46

jasnell requested a review from mcollina July 7, 2026 03:27

mcollina approved these changes Jul 7, 2026
View reviewed changes

mcollina requested changes Jul 7, 2026
View reviewed changes

test: cover deep-tree readdir to guard against stack overflow
b0e0986

mcollina approved these changes Jul 9, 2026
View reviewed changes

mcollina added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 9, 2026

github-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 9, 2026

This comment was marked as outdated.
Sign in to view

AkshatOP requested a review from mcollina July 14, 2026 20:22

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Jul 21, 2026

nodejs-github-bot merged commit 4bec191 into nodejs:mainJul 21, 2026
79 checks passed

github-actionsBot mentioned this pull request Jul 21, 2026
2026-07-22, Version 26.6.0 (Current) #64655
Merged

Uh oh!

Uh oh!

Conversation

AkshatOP commented Jun 26, 2026

Uh oh!

jasnellJun 27, 2026

Choose a reason for hiding this comment

Uh oh!

AkshatOPJun 27, 2026

Choose a reason for hiding this comment

Uh oh!

jojin1709 commented Jun 27, 2026

Uh oh!

AkshatOP commented Jun 29, 2026

Uh oh!

AkshatOP commented Jul 5, 2026

Uh oh!

jasnell commented Jul 7, 2026

Uh oh!

mcollina left a comment

Choose a reason for hiding this comment

Uh oh!

mcollina left a comment

Choose a reason for hiding this comment

Uh oh!

AkshatOP commented Jul 7, 2026

Uh oh!

mcollina left a comment

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

codecovBot commented Jul 9, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

nodejs-github-bot commented Jul 10, 2026

Uh oh!

AkshatOP commented Jul 14, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

codecovBot commented Jul 9, 2026•
edited
Loading