Last 12 weeks · 0 commits
1 of 6 standards met
Summary Fix a process crash vulnerability in the function when fails. Finding: Unhandled Error Event Crashing Process (Medium) File: , lines 25–28 Issue: The function does not attach an event handler. When fails (e.g., EADDRINUSE, EACCES, invalid arguments), Node.js emits an unhandled event, which crashes the process with . Additionally, never settles, creating a dangling unresolved promise. Fix: Added between and events Errors from are now properly propagated as promise rejections instead of crashing the process Verification ✅ Promise resolves correctly when server listens successfully ✅ Promise rejects with the error when fails ✅ Backward compatible — interface unchanged Related CWE-754: Improper Check for Unusual Conditions 🔒 Security Note for Vercel Security Team This PR fixes a process crash vulnerability. This finding may be eligible for the Vercel Open Source Bug Bounty Program** (Tier 2: $250–$5,000). Ref: https://hackerone.com/vercel-open-source
Repository: vercel/async-listen. Description: Promisify server.listen for your HTTP/HTTPS/TCP server. Stars: 56, Forks: 6. Primary language: TypeScript. Languages: TypeScript (97.2%), JavaScript (2.8%). Homepage: https://npmjs.com/async-listen Latest release: 3.1.0 (1y ago). Open PRs: 1, open issues: 0. Last activity: 3mo ago. Community health: 37%. Top contributors: TooTallNate, Kikobeats, styfle, Ethan-Arrowood.