Repository navigation
chore: track upstream SRT master fix (Haivision/srt#3354, closed 09-15) for #91, and #90 still awaits merge #93
Description
Context
Haivision/srt#3354 (the upstream heap-corruption/hang bug behind node-srt#91, "AsyncSRT.dispose()/
worker.terminate() causes native heap corruption") was closed 2026-09-15. The maintainer's comment thread
confirms: rebuilt against current master (cae8f624), the same repro suite that previously crashed reliably ran
6/6 clean.
The gap
The latest tagged release, v1.5.7 (published 2026-08-28), predates the 09-15 fix confirmation on
master. No tag yet contains the fix, so node-srt#91 cannot be closed by re-pinning to an existing release.
Separately, node-srt#90 (bump bundled libSRT v1.5.5 -> v1.5.6, fixing CVE-2026-55869 / CVE-2026-55868) is
unrelated to #91 and has sat open since 2026-08-13: mergeable: MERGEABLE, mergeStateStatus: UNSTABLE, and
is explicitly flagged in its own body as a "Tier B" native-build change awaiting a human maintainer rather than
auto-merge, even with the CVE fix verified.
Ask
- Track
Haivision/srtfor the next tagged release containingcae8f624(or later); when it lands, re-verify
AsyncSRT.dispose()/worker.terminate() causes native heap corruption (reproduces on v1.5.5 and v1.5.6) #91's repro against it and updatescripts/build-srt-sdk.js'sSRT_CHECKOUTpin accordingly. - Separately, Bump bundled libSRT to v1.5.6 (fixes CVE-2026-55869, CVE-2026-55868) #90 is CI-green and CVE-verified; it just needs the named human merge decision it has been
waiting 35 days for.
Actionability
- Who can act: Birme's team (merge Bump bundled libSRT to v1.5.6 (fixes CVE-2026-55869, CVE-2026-55868) #90 now; watch for the next SRT tag for AsyncSRT.dispose()/worker.terminate() causes native heap corruption (reproduces on v1.5.5 and v1.5.6) #91).
- Type of work: chore / dependency tracking
- Effort: S (tracking note + a merge decision)
- Blocked by: upstream tag cut for AsyncSRT.dispose()/worker.terminate() causes native heap corruption (reproduces on v1.5.5 and v1.5.6) #91's half; nothing for Bump bundled libSRT to v1.5.6 (fixes CVE-2026-55869, CVE-2026-55868) #90's half.
- Demo-critical: No.
Activity
birme commentedon Sep 18, 2026
Thank you for the detailed status update, @alexbj75 — this is genuinely useful to have on record.
To confirm the current state of both tracks:
Track 1 — Haivision/srt#3354 / issue #91 (AsyncSRT heap corruption):
You are correct that Haivision/srt#3354 was closed on 2026-09-15 with the fix confirmed on upstream
master. However, no new tagged SRT release yet includes this commit. PR #90 targets a tagged version pin (not a floatingmasterref), so we need to wait for an official upstream tag (e.g. v1.5.7 or later) containing that fix before we can re-verify the issue #91 repro against a releasable build. The team is watching the Haivision/srt release feed; once a tag lands we will updateSRT_CHECKOUTinscripts/build-srt-sdk.jsand re-run the test suite.Track 2 — PR #90 (CVE bump, v1.5.5 → v1.5.6):
PR #90 is already labeled
ready-for-maintainer. To clarify its current merge-readiness: Linux CI was failing with a SIGSEGV at process exit due to an upstream regression (1e4c908cin Haivision/srt#3327) — the same commit that Haivision/srt#3354 has now fixed onmaster. Both tracks are unblocked by the same upstream tagged release. Once it lands:SRT_CHECKOUTwill be updated to the new tag.Your filing of this issue has added useful context and we've noted the 2026-09-15 upstream closure date. We will follow up here when the upstream tag lands.
— node-srt maintenance bot