From 7788bf48e2bd57a04c4e53902b6516737f6c4636 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Guilherme=20Ara=C3=BAjo?= <arauujogui@gmail.com>
Date: Wed, 29 Jul 2026 21:41:58 -0300
Subject: [PATCH] net: reject non-address SocketAddress.parse input
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
---
 doc/api/net.md                      |  5 ++++
 lib/internal/socketaddress.js       | 10 ++++++++
 test/parallel/test-socketaddress.js | 36 +++++++++++++++++++++++++++++
 3 files changed, 51 insertions(+)

diff --git a/doc/api/net.md b/doc/api/net.md
index 988bc5669e7f..d2e4f8f8d8aa 100644
--- a/doc/api/net.md
+++ b/doc/api/net.md
@@ -295,6 +295,11 @@ added:
 * Returns: {net.SocketAddress} Returns a `SocketAddress` if parsing was successful.
   Otherwise returns `undefined`.
 
+The `input` may contain only hexadecimal digits, `x`, `.`, `:`, `[`, and `]`.
+Anything else returns `undefined`, including other URL components such as
+`user@1.2.3.4` or `1.2.3.4/foo`, whitespace, control characters,
+percent-encoding, and non-ASCII characters.
+
 ## Class: `net.Server`
 
 <!-- YAML
diff --git a/lib/internal/socketaddress.js b/lib/internal/socketaddress.js
index 724ffd90cf77..8a2e1fc2c230 100644
--- a/lib/internal/socketaddress.js
+++ b/lib/internal/socketaddress.js
@@ -2,6 +2,7 @@
 
 const {
   ObjectSetPrototypeOf,
+  RegExpPrototypeExec,
   Symbol,
 } = primordials;
 
@@ -42,6 +43,11 @@ const { URLParse } = require('internal/url');
 const kHandle = Symbol('kHandle');
 const kDetail = Symbol('kDetail');
 
+// The complete character set of an "${address}:${port}" input. Everything else
+// is rejected: delimiters that would introduce a userinfo, path, query, or
+// fragment component, and characters the URL parser strips, decodes, or remaps.
+const kValidInput = /^[0-9a-fA-FxX.:[\]]+$/;
+
 class SocketAddress {
   static isSocketAddress(value) {
     return value?.[kHandle] !== undefined;
@@ -149,6 +155,10 @@ class SocketAddress {
    */
   static parse(input) {
     validateString(input, 'input');
+    // The URL parser below silently discards anything that is not the host or
+    // port, and percent-decodes and IDNA-maps what remains, so restrict the
+    // input to characters that can appear in an address and port first.
+    if (RegExpPrototypeExec(kValidInput, input) === null) return;
     // While URL.parse is not expected to throw, there are several
     // other pieces here that do... the destucturing, the SocketAddress
     // constructor, etc. So we wrap this in a try/catch to be safe.
diff --git a/test/parallel/test-socketaddress.js b/test/parallel/test-socketaddress.js
index cf29795a48fc..7ed1338828be 100644
--- a/test/parallel/test-socketaddress.js
+++ b/test/parallel/test-socketaddress.js
@@ -162,6 +162,42 @@ describe('net.SocketAddress...', () => {
       'abc.123',
       '259.1.1.1',
       '12:12:12',
+      // Arbitrary URL components.
+      'user:80@5.6.7.8',
+      'user@1.2.3.4',
+      '1.2.3.4/',
+      '1.2.3.4/foo',
+      '1.2.3.4\\foo',
+      '1.2.3.4?a=b',
+      '1.2.3.4#frag',
+      '[1::8]:123/x',
+      'http://1.2.3.4',
+      // Whitespace and control characters.
+      '1.2.3\n.4',
+      '1.2.3\t.4',
+      '1.2.3.4\r',
+      '1.2.3.4 ',
+      ' 1.2.3.4',
+      '1.2.3.4\x00',
+      '1.2.3.4\x0b',
+      '1.2.3.4\x7f',
+      // Percent-encoding.
+      '1.2.3.%34',
+      '1%2E2%2E3%2E4',
+      '%30%78%66%66%66%66%66%66%66%66',
+      '1.2.3.%34:8080',
+      // IDNA.
+      '１２７.０.０.１',
+      '０ｘ７ｆ.1',
+      '1。2。3。4',
+      '1｡2｡3｡4',
+      '⑧.0.0.1',
+      '1.2.3.4\u200b',
+      '1.2.3.4\ufeff',
+      '1.2.3.4\u00ad',
+      '1.2.3.4\u180e',
+      '1.2.3.4\u2064',
+      '1.2.3.4\ufe00',
     ];
 
     bad.forEach((i) => {