# `fs.realpath.native` on darwin may cause buffer overflow

libuv realpath on macOS sizes its buffer via pathconf with 256-byte fallback, overflowing when resolved paths exceed that, crashing Node.

- Payout: hidden
- Severity: medium
- Program: Node.js
- Found by: ashi009
- Disclosed: 2020-10-17
- CVE: CVE-2020-8252
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/965914
- Library page: https://bugbountylibrary.com/r/h1%3A965914
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:nodejs technique:source-review vuln:dos vuln:memory-corruption

**Target:** libuv realpath implementation on darwin (macOS)
**Root cause:** libuv's realpath sizes the buffer with pathconf, falling back to _POSIX_PATH_MAX (256) on failure like ENOENT, but realpath requires at least PATH_MAX (1024) bytes, so longer resolved paths overflow the buffer.
**Steps:**
1. Create a long directory path >256 bytes: `mkdir -p /tmp/long/.../path/254B`
2. Symlink a short path to it: `ln -s "$LONG_PATH" /tmp/short`
3. Run `node -e "fs.realpathSync.native('/tmp/short/file-not-exist')"`
4. Observe buffer overflow / process crash
**How found:** Code reading of libuv's realpath: noticed pathconf fallback to _POSIX_PATH_MAX (256) instead of PATH_MAX (1024), hypothesized overflow on long resolved paths.
**Exploitation:** Local attacker or crafted path causes Node process to crash; no memory corruption exploitation demonstrated beyond DoS.
**Insight:** When auditing path-handling code, check whether buffer sizing uses pathconf with a small fallback constant rather than PATH_MAX; symlinks to long paths plus a nonexistent trailing component trigger the ENOENT fallback path.