# Uncaught parse and nil-deref crashes

Network-response parsing and schema decoding without try/catch or nil checks, crashing the process

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; one confirmed bounty: $500; latest 2026-10-16. Updated 2026-10-23._

## How it works
Handlers assume the data they parse is well-formed and non-nil. When an attacker controls a response body, header, or schema shape, that assumption breaks: `JSON.parse` on an empty body throws, or a decoder dereferences a nil schema/`Items` pointer. If the throw happens inside a callback with no `error` listener, or the nil deref happens in a library with no recovery, the whole process dies. The root cause is missing validation and missing error containment on an attacker-reachable path.

## Where it shows up
- `JSON.parse(...)` on a response body inside an EventEmitter `'end'`/`'data'` callback with no try/catch and no `'error'` listener [E2](https://bugbountylibrary.com/r/h1%3A506412.md).
- Error paths that parse the body instead of checking `statusCode` first [E2](https://bugbountylibrary.com/r/h1%3A506412.md).
- Schema decoders that dereference `schema.Value.AllOf` or `schema.Value.Items` without a nil check [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-74vm-87hj-r66f.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-vrcc-3ch7-hppw.md).
- Response headers declared with `content` instead of `schema`, yielding a nil schema [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-74vm-87hj-r66f.md).
- Recursive schema walkers (`allOf`/`anyOf`/`oneOf`, `deepObject`) that bypass top-level guards [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-vrcc-3ch7-hppw.md).

## How to review
Trace every attacker-influenced input to its parse/decode site. The invariant: any parse of network data is wrapped so a throw cannot escape the handler, and every schema/pointer dereference is preceded by a nil check. Check that a `'error'` listener exists on emitters, that `statusCode` is validated before body parsing, and that guards cover all call sites of a shared decoder helper, not just patched entry points [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-vrcc-3ch7-hppw.md). Confirm the body path's early nil return also exists on the header path [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-74vm-87hj-r66f.md).

## Variants seen
- Empty response body parsed in an uncaught emitter callback [E2](https://bugbountylibrary.com/r/h1%3A506412.md).
- Nil schema for a response header declared with `content` [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-74vm-87hj-r66f.md).
- Nil `Items` in query, deepObject, and allOf urlencoded body paths [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-vrcc-3ch7-hppw.md).

## Why fixes fail
E3 shows a prior nil-deref fix that guarded only top-level properties and standalone `parseArray`, leaving query params, deepObject recursion, and sub-schemas unpatched. E1 notes a sibling advisory fixed one input path while the parallel header path stayed vulnerable.

## Impact and severity
Unauthenticated requests crash the host process, causing denial of service. Severity rises when the crash is reachable pre-auth and on every call to an operation [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-74vm-87hj-r66f.md), and when the same class recurs across multiple paths after a partial fix [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-vrcc-3ch7-hppw.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-74vm-87hj-r66f.md
- E2: https://bugbountylibrary.com/r/h1%3A506412.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-vrcc-3ch7-hppw.md