Passing large value for mode option in `fs.createWriteStream` results in crash

[kevgeoleo]

Version

v24.13.1, v25.8.1

Platform

Linux KContainer 5.10.0-12-amd64 #1 SMP Debian 5.10.103-1 (2022-03-07) x86_64 x86_64 x86_64 GNU/Linux

Subsystem

node fs

What steps will reproduce the bug?

Hi,

The bug can be reproduced using the below snippet:

const { createWriteStream } = require('fs');

createWriteStream('./1.txt', {
  mode: 2176057344,
});

How often does it reproduce? Is there a required condition?

Now special condition. Reproduces all the time

What is the expected behavior? Why is that the expected behavior?

Throw a RangeError which is catchable

root@KContainer:~/37430# deno run -A repro.cjs
error: Uncaught RangeError: The value of "mode" is out of range. It must be >= 0 && <= 4294967295. Received 2176057344
    at parseFileMode (ext:deno_node/internal/validators.mjs:68:3)
    at Module.open (node:fs:1096:12)
    at WriteStream._construct (ext:deno_node/internal/fs/streams.mjs:78:17)
    at constructNT (ext:deno_node/internal/streams/destroy.js:307:12)
    at processTicksAndRejections (ext:core/01_core.js:370:17)
    at drainTicks (ext:core/01_core.js:427:5)

What do you see instead?

Assertion failure

root@KContainer:~/37430# node repro.cjs

  #  node[2434]: void node::fs::Open(const v8::FunctionCallbackInfo<v8::Value>&) at ../src/node_file.cc:2157
  #  Assertion failed: args[2]->IsInt32()

----- Native stack trace -----

 1: 0x8aa857 node::Assert(node::AssertionInfo const&) [node]
 2: 0x8c4c3a  [node]
 3: 0x7f540fdcf08d

----- JavaScript stack trace -----

1: open (node:fs:548:11)
2: _construct (node:internal/fs/streams:73:17)
3: constructNT (node:internal/streams/destroy:300:12)
4: processTicksAndRejections (node:internal/process/task_queues:88:21)


Aborted

Additional information

This was previously reported and fixed. I believe this is a regression
#37430

[semimikoh]

This looks like a regression introduced by #52050, which moved mode validation from JS (parseFileMode) to the C++ layer.

The value 2176057344 is within the UInt32 range but exceeds the Int32 range, so the C++ assertion args[2]->IsInt32() in src/node_file.cc crashes instead of throwing a catchable RangeError.

I'd like to work on a fix. I see two possible approaches:

Approach A: Change parseFileMode() in lib/internal/validators.js to use validateInt32 instead of validateUint32, aligning JS validation with the C++ expectation. This is cleaner but affects all fs functions that use parseFileMode and could be considered semver-major.

Approach B: Keep parseFileMode() as-is, and only add parseFileMode() calls in the ReadStream/WriteStream constructors in lib/internal/fs/streams.js with an additional Int32 range check. This minimizes the impact but is less consistent.

Which approach would be preferred? I'll also add regression tests for both createWriteStream and createReadStream with this value.

cc @anonrig

[kevgeoleo]

Hi,
Could you please assign a label to this issue?