oven-sh · Jarred-Sumner · Jul 25, 2026 · Jun 29, 2026 · Jul 7, 2026 · Jul 7, 2026
diff --git a/.claude/commands/upgrade-boringssl.md b/.claude/commands/upgrade-boringssl.md
@@ -45,7 +45,7 @@ In the bun repo:
 
 - `scripts/build/deps/boringssl.ts` — set `BORINGSSL_COMMIT` to `$NEW_SHA`.
 - `test/js/node/process/process.test.js` — update the `boringssl:` entry in `expectedVersions` to `$NEW_SHA`.
-- `src/js/node/tls.ts` — two hand-maintained mirrors of BoringSSL tables must be re-derived from the new pin (a test pins the current set, but cannot see upstream additions on its own): `_VALID_CIPHERS_SET` ← `ssl/ssl_cipher.cc` `kCiphers`, `CIPHER_LIST_SELECTORS` ← `ssl/ssl_cipher.cc` `kCipherAliases`.
+- `src/js/node/tls.ts` — three hand-maintained mirrors of BoringSSL tables must be re-derived from the new pin (a test pins the current set, but cannot see upstream additions on its own): `SUPPORTED_ECDH_GROUPS` ← `ssl/ssl_key_share.cc` `kNamedGroups` (every `name` and non-empty `alias`), `_VALID_CIPHERS_SET` ← `ssl/ssl_cipher.cc` `kCiphers`, `CIPHER_LIST_SELECTORS` ← `ssl/ssl_cipher.cc` `kCipherAliases`.
 - Regenerate the source lists (the file's header comment has the exact one-liner). Only `gen/sources.json` is authoritative — diff old vs new and apply the delta:
 
   ```sh

diff --git a/packages/bun-usockets/src/crypto/openssl.c b/packages/bun-usockets/src/crypto/openssl.c
diff --git a/packages/bun-usockets/src/libusockets.h b/packages/bun-usockets/src/libusockets.h
@@ -417,6 +417,12 @@ void us_listen_socket_on_server_name(struct us_listen_socket_t *ls,
  * after the socket closed (no-op). */
 void us_socket_sni_resolve(us_socket_r s, struct ssl_ctx_st *ctx, int error);
 void *us_socket_server_name_userdata(us_socket_r s);
+/* Socket-level SNI resolver, for a server-side socket adopted into TLS with no
+ * listen socket behind it. Same contract as the listener resolver: an owned
+ * SSL_CTX ref or NULL; *abort_handshake 1 = drop silently, 2 = suspend. */
+typedef struct ssl_ctx_st *(*us_socket_server_name_cb)(struct us_socket_t *socket,
+    const char *hostname, int *abort_handshake);
+void us_socket_on_server_name(us_socket_r s, us_socket_server_name_cb cb);
 
 /* ── Connect ──────────────────────────────────────────────────────────────
  * Returns either us_socket_t* (fast path, *is_connecting=1) or

diff --git a/src/js/internal/test/binding.ts b/src/js/internal/test/binding.ts
@@ -65,6 +65,10 @@ function internalBinding(name: string) {
       return { UDP: require("internal/dgram").UDP };
     case "tcp_wrap":
       return { TCP: TestTCPWrap, constants: { SOCKET: 0, SERVER: 1 } };
+    case "cares_wrap":
+      // Only the pure IP-normalizer the vendored tls/dns tests reach for; the
+      // resolver surface lives in node:dns.
+      return { canonicalizeIP: require("bun:internal-for-testing").canonicalizeIP };
     default:
       throw new Error(`internalBinding("${name}") is not implemented in Bun`);
   }

diff --git a/src/js/node/net.ts b/src/js/node/net.ts
@@ -143,10 +143,12 @@ const kAttach = Symbol("kAttach");
 const kCloseRawConnection = Symbol("kCloseRawConnection");
 const kpendingRead = Symbol("kpendingRead");
 const kupgraded = Symbol("kupgraded");
+const kAdoptedTLSRaw = Symbol("kAdoptedTLSRaw");
 const ksocket = Symbol("ksocket");
 const khandlers = Symbol("khandlers");
 const kclosed = Symbol("closed");
 const kended = Symbol("ended");
+const kReaderInterest = Symbol("kReaderInterest");
 const kpendingSession = Symbol("pendingSession");
 const kSNIError = Symbol("kSNIError");
 const kALPNError = Symbol("kALPNError");
@@ -237,6 +239,16 @@ function endNT(socket, callback, err) {
 function emitCloseNT(self, hasError) {
   self.emit("close", hasError);
 }
+// Shared-fd TLS pair teardown: mirrors node's close ordering, where the
+// close-callbacks phase runs after the check phase (lib/net.js close path in
+// node v26.3.0), so destroy()-time setImmediates still see the pair alive.
+function closeAdoptedTLSRawNT(handle, self, isException) {
+  setImmediate(closeAdoptedTLSRawNowNT, handle, self, isException);
+}
+function closeAdoptedTLSRawNowNT(handle, self, isException) {
+  handle.close(onSocketHandleClosed);
+  setImmediate(emitCloseNT, self, isException);
+}
 function detachSocket(self) {
   if (!self) self = this;
   self._handle = null;
@@ -628,6 +640,9 @@ function SocketEmitEndNT(self, _err?) {
   }
   if (!self[kended]) {
     finishSocketEnd(self);
+    if (!self.allowHalfOpen && self[kReaderInterest] === false) {
+      setImmediate(destroyAbandonedNT, self);
+    }
   } else if (_err && !self.destroyed) {
     // An error excluded from the synthesis above (teardown noise, or no
     // listener attached): nothing more is coming, but the socket still has to
@@ -936,31 +951,39 @@ const ServerHandlers: SocketHandler<NetSocket> = {
     if (pauseOnConnect) {
       self.pause();
     }
-    if (server) {
-      // onServerSocketSecure hands the socket to the user before emitting
-      // 'secureConnection': from here on errors reach the user's 'error'
-      // listener instead of the server's 'tlsClientError'. A socket destroyed
-      // mid-handshake, or one whose control was already released by an earlier
-      // completion, is dropped here.
-      // https://github.com/nodejs/node/blob/v26.3.0/lib/internal/tls/wrap.js#L1227
-      if (!self.destroyed && self._releaseControl()) {
-        const connectionListener = server[bunSocketServerOptions]?.connectionListener;
-        if (typeof connectionListener === "function") {
-          server.prependOnceListener("secureConnection", connectionListener);
+    try {
+      if (server) {
+        // onServerSocketSecure hands the socket to the user before emitting
+        // 'secureConnection': from here on errors reach the user's 'error'
+        // listener instead of the server's 'tlsClientError'. A socket destroyed
+        // mid-handshake, or one whose control was already released by an earlier
+        // completion, is dropped here.
+        // https://github.com/nodejs/node/blob/v26.3.0/lib/internal/tls/wrap.js#L1227
+        if (!self.destroyed && self._releaseControl()) {
+          const connectionListener = server[bunSocketServerOptions]?.connectionListener;
+          if (typeof connectionListener === "function") {
+            server.prependOnceListener("secureConnection", connectionListener);
+          }
+          server.emit("secureConnection", self);
         }
-        server.emit("secureConnection", self);
       }
-    }
-    if (self.destroyed) return;
-    // after secureConnection event we emmit secure and secureConnect
-    self.emit("secure", self);
-    self.emit("secureConnect", verifyError);
-    if (!pauseOnConnect && !self.destroyed) {
-      // Node's server-side TLSSocket is manualStart: initRead() only read(0)s
-      // the handle, leaving readableFlowing null, so bytes that arrive before
-      // a 'data' listener attaches are buffered instead of dropped.
-      // https://github.com/nodejs/node/blob/v26.3.0/lib/internal/tls/wrap.js#L502-L524
-      self.read(0);
+      if (self.destroyed) return;
+      // after secureConnection event we emmit secure and secureConnect
+      self.emit("secure", self);
+      self.emit("secureConnect", verifyError);
+    } catch (err) {
+      // A throwing listener is a programmer error, not a TLS failure: Node
+      // crashes with an uncaught exception instead of feeding the socket error
+      // path (node v26.3.0 lib/_tls_wrap.js; test-tls-handshake-exception).
+      process.nextTick(rethrowUncaught, err);
+    } finally {
+      if (!pauseOnConnect && !self.destroyed) {
+        // Node's server-side TLSSocket is manualStart: initRead() only read(0)s
+        // the handle, leaving readableFlowing null, so bytes that arrive before
+        // a 'data' listener attaches are buffered instead of dropped.
+        // https://github.com/nodejs/node/blob/v26.3.0/lib/internal/tls/wrap.js#L502-L524
+        self.read(0);
+      }
     }
   },
   error(socket, error) {
@@ -1028,6 +1051,10 @@ const ServerHandlers: SocketHandler<NetSocket> = {
   binaryType: "buffer",
 } as const;
 
+function rethrowUncaught(err) {
+  throw err;
+}
+
 function applyRejectUnauthorized(self, tls, rejectUnauthorized) {
   if (typeof rejectUnauthorized !== "undefined") {
     self._rejectUnauthorized = rejectUnauthorized !== false;
@@ -1183,10 +1210,31 @@ function onconnection(err, clientHandle) {
   }
   if (isTLS) initAcceptedTLSSocket(self, _socket);
 
+  // Mark server-accepted sockets as candidates for abandoned-socket teardown
+  // (SocketEmitEndNT schedules destroyAbandonedNT only when this is exactly
+  // false; client sockets never have it set so are excluded).
+  _socket[kReaderInterest] = false;
   self.emit("connection", _socket);
   if (!pauseOnConnect && !isTLS) {
     _socket.read(0);
   }
+  if (_socket.readableFlowing !== null || _socket.listenerCount("data") > 0 || _socket.listenerCount("readable") > 0) {
+    _socket[kReaderInterest] = true;
+  }
+}
+
+function destroyAbandonedNT(self) {
+  if (
+    self.destroyed ||
+    self[kReaderInterest] !== false ||
+    self.readableLength === 0 ||
+    self.readableFlowing !== null ||
+    self.listenerCount("data") > 0 ||
+    self.listenerCount("readable") > 0
+  ) {
+    return;
+  }
+  self.destroySoon();
 }
 
 // TODO: SocketHandlers2 is a bad name but its temporary. reworking the Server in a followup PR
@@ -1813,7 +1861,10 @@ Socket.prototype._onTimeout = function () {
 
 Object.defineProperty(Socket.prototype, "bufferSize", {
   get: function () {
-    return this.writableLength;
+    // Node returns undefined once the handle is gone (after close).
+    if (this._handle) {
+      return this.writableLength;
+    }
   },
 });
 
@@ -2001,7 +2052,7 @@ Socket.prototype.connect = function connect(...args) {
         const socket = connection._handle;
         if (!upgradeDuplex && socket) {
           // if is named pipe socket we can upgrade it using the same wrapper than we use for duplex
-          upgradeDuplex = isNamedPipeSocket(socket);
+          upgradeDuplex = isNamedPipeSocket(socket) || hasUnflushedWrites(connection);
         }
         if (upgradeDuplex) {
           this[kupgraded] = connection;
@@ -2031,6 +2082,7 @@ Socket.prototype.connect = function connect(...args) {
               const [raw, tls] = result;
               // replace socket
               connection._handle = raw;
+              raw[kAdoptedTLSRaw] = true;
               this.once("end", this[kCloseRawConnection]);
               raw.connecting = false;
               this._handle = tls;
@@ -2051,7 +2103,7 @@ Socket.prototype.connect = function connect(...args) {
               const socket = connection._handle;
               if (!upgradeDuplex && socket) {
                 // if is named pipe socket we can upgrade it using the same wrapper than we use for duplex
-                upgradeDuplex = isNamedPipeSocket(socket);
+                upgradeDuplex = isNamedPipeSocket(socket) || hasUnflushedWrites(connection);
               }
               if (upgradeDuplex) {
                 this[kupgraded] = connection;
@@ -2077,6 +2129,7 @@ Socket.prototype.connect = function connect(...args) {
                   const [raw, tls] = result;
                   // replace socket
                   connection._handle = raw;
+                  raw[kAdoptedTLSRaw] = true;
                   this.once("end", this[kCloseRawConnection]);
                   raw.connecting = false;
                   this._handle = tls;
@@ -2193,6 +2246,7 @@ Socket.prototype._destroy = function _destroy(err, callback) {
     // this[kBytesRead] = this._handle.bytesRead;
     this[kBytesWritten] = this._handle.bytesWritten;
 
+    const currentHandle = this._handle;
     if (this.resetAndClosing) {
       this.resetAndClosing = false;
       // resetAndDestroy() must send an RST (not a graceful FIN) so the peer sees
@@ -2209,6 +2263,11 @@ Socket.prototype._destroy = function _destroy(err, callback) {
       // Enqueue closing the socket as a microtask, so that the socket can be
       // accessible when an `error` event is handled in the `next tick queue`.
       queueMicrotask(() => closeSocketHandle(this, isException, true));
+    } else if (currentHandle[kAdoptedTLSRaw]) {
+      // Shared-fd TLS pair: defer the close two check-phase turns
+      // (test-tls-socket-close); see closeAdoptedTLSRawNT.
+      currentHandle.pause?.();
+      setImmediate(closeAdoptedTLSRawNT, currentHandle, this, isException);
     } else {
       closeSocketHandle(this, isException);
     }
@@ -2279,6 +2338,13 @@ Object.defineProperty(Socket.prototype, "pending", {
   },
 });
 
+// Queued/in-flight plain writes would be stranded on the retired TCP wrapper
+// if the fd were adopted; such sockets use the stream-level TLS engine, whose
+// ciphertext queues behind the pending writes (order + callbacks preserved).
+function hasUnflushedWrites(connection) {
+  return connection.writableLength > 0 || connection[kwriteCallback] != null;
+}
+
 function drainOnreadTail(self, fromRead?) {
   if (self[kOnreadTail] === undefined) return false;
   if (fromRead) self[kOnreadReadRequested] = true;
@@ -2351,10 +2417,10 @@ Socket.prototype.pause = function pause() {
 // state carried via `data` (mirrors tls.createServer's one-handler-for-all model).
 Socket.prototype[Symbol.for("::bunUpgradeServerTLS::")] = function (connection, tls) {
   const socket = connection._handle;
-  if (!socket) {
-    // A generic Duplex (or a not-yet-connected net.Socket) has no native fd
-    // to adopt into a TLS socket; run the TLS engine over the stream itself.
-    // The returned events feed the stream's bytes into the engine and back.
+  if (!socket || connection.encrypted || hasUnflushedWrites(connection)) {
+    // No adoptable fd (generic Duplex / not yet connected), TLS over TLS (the
+    // fd belongs to the outer SSL layer), or pending plain writes that must
+    // flush first: run the TLS engine over the stream itself.
     const [result, events] = upgradeDuplexToTLS(connection, {
       data: this,
       tls,
@@ -2380,6 +2446,23 @@ Socket.prototype[Symbol.for("::bunUpgradeServerTLS::")] = function (connection,
       this.destroy();
       return;
     }
+    // Writes may have been queued between the wrap and this tick (a user
+    // 'connection' listener runs after the server's): those bytes must flush
+    // before any TLS output, so fall back to the stream-level engine.
+    if (hasUnflushedWrites(connection)) {
+      const [result, events] = upgradeDuplexToTLS(connection, {
+        data: this,
+        tls,
+        socket: serverHandlersFor(this),
+        isServer: true,
+      });
+      connection.on("data", events[0]);
+      connection.on("end", events[1]);
+      connection.on("drain", events[2]);
+      connection.on("close", events[3]);
+      this._handle = result;
+      return;
+    }
     // Bytes that already arrived before the wrap were pulled off the fd into
     // the connection's readable buffer; hand them to the TLS engine so the
     // handshake doesn't stall.
@@ -2398,6 +2481,7 @@ Socket.prototype[Symbol.for("::bunUpgradeServerTLS::")] = function (connection,
     }
     const [raw, tlsHandle] = result;
     connection._handle = raw;
+    raw[kAdoptedTLSRaw] = true;
     this.once("end", this[kCloseRawConnection]);
     raw.connecting = false;
     this._handle = tlsHandle;

diff --git a/src/js/node/tls.ts b/src/js/node/tls.ts
@@ -181,6 +181,20 @@ function validateCiphers(ciphers: string, name: string = "options") {
 
 const VALID_TLS_VERSIONS = new Set(["TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3"]);
 
+const SUPPORTED_ECDH_GROUPS = new Set([
+  "P-256",
+  "prime256v1",
+  "P-384",
+  "secp384r1",
+  "P-521",
+  "secp521r1",
+  "X25519",
+  "x25519",
+  "X25519Kyber768Draft00",
+  "X25519MLKEM768",
+  "MLKEM1024",
+]);
+
 // Subset of Node's configSecureContext() validations:
 // https://github.com/nodejs/node/blob/843dc5f0d5ad/lib/internal/tls/secure-context.js#L318
 function validateSecureContextOptions(options) {
@@ -204,7 +218,18 @@ function validateSecureContextOptions(options) {
     validateString(sigalgs, "options.sigalgs");
     if (sigalgs === "") throw $ERR_INVALID_ARG_VALUE("options.sigalgs", sigalgs);
   }
-  if (ecdhCurve !== undefined) validateString(ecdhCurve, "options.ecdhCurve");
+  if (ecdhCurve !== undefined) {
+    validateString(ecdhCurve, "options.ecdhCurve");
+    if (ecdhCurve !== "auto") {
+      for (const curve of StringPrototypeSplit.$call(ecdhCurve, ":")) {
+        if (!SUPPORTED_ECDH_GROUPS.has(curve)) {
+          const err = new Error("Failed to set ECDH curve") as Error & { code: string };
+          err.code = "ERR_CRYPTO_OPERATION_FAILED";
+          throw err;
+        }
+      }
+    }
+  }
   // clientCertEngine must be a string (engine name); a provided engine then
   // fails because BoringSSL (which Bun always uses) has no OpenSSL ENGINE
   // support, matching Node's setClientCertEngine. Node:
@@ -957,6 +982,11 @@ TLSSocket.prototype.getTLSTicket = function getTLSTicket() {
   return this._handle?.getTLSTicket?.();
 };
 
+// Lets net.ts's SNI dispatch recognize a raw native SecureContext returned by
+// a socket-level SNICallback (`new tls.TLSSocket(sock, { isServer: true,
+// SNICallback })`), where the handler's `this` is the socket, not a Server.
+TLSSocket.prototype[kNativeSecureContextCtor] = NativeSecureContext;
+
 TLSSocket.prototype.setKeyCert = function setKeyCert(context) {
   // Serve this connection's identity from the given context (Node calls this
   // from ALPNCallback/SNICallback before the certificate is sent). Accepts a
@@ -1434,7 +1464,12 @@ function Server(options, secureConnectionListener): void {
   this._handshakeTimeout = handshakeTimeout;
 
   this.on("connection", socket => {
-    if (!socket || socket.encrypted || socket instanceof TLSSocket) return;
+    // Skip only sockets this server's own native accept path already wrapped
+    // (those arrive as an encrypted TLSSocket with .server preassigned).
+    // Anything else - plain or TLS from another server - gets a server-side
+    // TLS layer, like Node's tls.Server wraps any injected duplex
+    // (node v26.3.0 lib/_tls_wrap.js, Server's connection listener).
+    if (!socket || (socket.encrypted && socket.server === this)) return;
     let secureContext = this._sharedCreds;
     if (!secureContext) {
       try {

diff --git a/src/runtime/api/SecureContext.classes.ts b/src/runtime/api/SecureContext.classes.ts
@@ -17,13 +17,18 @@ export default [
       // the regular key/cert/ca option plumbing can consume it.
       parsePkcs12: { fn: "parse_pkcs12", length: 2 },
     },
-    // No prototype surface — node:tls hands out the SecureContext object
-    // itself as `.context`. We deliberately do NOT expose the underlying
-    // SSL_CTX* to JS: a Number would lose precision above 2^53, and Node's
-    // `context._external` is a V8 External (opaque) used only by N-API
-    // addons that link OpenSSL directly, which Bun's BoringSSL build can't
-    // satisfy anyway.
+    // node:tls hands out the SecureContext object itself as `.context`. We
+    // deliberately do NOT expose the underlying SSL_CTX* to JS: a Number
+    // would lose precision above 2^53, and Node's `context._external` is a
+    // V8 External (opaque) used only by N-API addons that link OpenSSL
+    // directly, which Bun's BoringSSL build can't satisfy anyway.
     proto: {
+      // Present so the accessor exists (and rejects a foreign receiver the
+      // way every other class getter does) rather than reading as a plain
+      // missing property; the value stays hidden, see above.
+      _external: {
+        getter: "get_external",
+      },
       // `secureContext.context.addCACert(pem)` — Node's SecureContext exposes
       // this so extra CAs can be appended to an existing context's store.
       addCACert: {