http2: guard against null write request on cancelled stream

Cancelling an in-flight `respondWithFile()` download can leave a file
read pending on the thread pool after the HTTP/2 stream has been
destroyed. When that read completes, `StreamPipe` forwards a null
`WriteWrap` to the previous listener, which dereferences it in
`ReportWritesToJSStreamListener::OnStreamAfterReqFinished()`, crashing
the server with a NULL pointer dereference (segfault).

Guard against a null stream and null request in
`OnStreamAfterReqFinished()` so the listener returns early.

Refs: https://hackerone.com/4150894
Refs: #64623
Signed-off-by: Matteo Collina <hello@matteocollina.com>
Assisted-by: pi
PR-URL: #67252
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-123875

Author: mcollina

src/stream_base.cc

@@ -804,6 +804,8 @@ void CustomBufferJSListener::OnStreamRead(ssize_t nread, const uv_buf_t& buf) {
 void ReportWritesToJSStreamListener::OnStreamAfterReqFinished(
     StreamReq* req_wrap, int status) {
   StreamBase* stream = static_cast<StreamBase*>(stream_);
+  if (stream == nullptr) return;
+  if (req_wrap == nullptr) return;
   Environment* env = stream->stream_env();
   if (!env->can_call_into_js()) return;
   AsyncWrap* async_wrap = req_wrap->GetAsyncWrap();

test/parallel/test-http2-respond-with-file-cancelled-crash.js

@@ -0,0 +1,51 @@
+'use strict';
+
+// Regression test for https://hackerone.com/4150894 (NULL dereference in
+// StreamPipe). Cancelling an in-flight `respondWithFile()` download while a
+// file read is still pending on the thread pool crashed the server: a NULL
+// WriteWrap was forwarded to ReportWritesToJSStreamListener, which then
+// dereferenced it in OnStreamAfterReqFinished().
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+const http2 = require('http2');
+
+const server = http2.createServer();
+server.on('stream', (stream) => {
+  stream.on('error', () => {});
+  // Use a file large enough that a read is still in flight when the client
+  // destroys the session.
+  stream.respondWithFile(process.execPath);
+});
+server.on('sessionError', () => {});
+
+server.listen(0, common.mustCall(() => {
+  const port = server.address().port;
+  const rounds = 50;
+  let i = 0;
+  let done = false;
+
+  function cancelOne() {
+    if (done) return;
+    if (i >= rounds) {
+      done = true;
+      server.close(common.mustCall());
+      return;
+    }
+    i++;
+    const client = http2.connect(`http://127.0.0.1:${port}`);
+    client.on('error', () => {});
+    const req = client.request({ ':path': '/' });
+    req.on('error', () => {});
+    req.resume();
+    // Destroy the session shortly after the request is sent, while the server
+    // may still be reading the file. Vary the delay to hit the race window.
+    setTimeout(() => {
+      client.destroy();
+      setTimeout(cancelOne, 1);
+    }, 3 + (i * 7) % 40);
+  }
+
+  cancelOne();
+}));