fix(kit): normalise Node.js Buffer to Uint8Array in SSR hydration to prevent pool bytes leaking into the page

[okxint]

closes #16603

What

Node.js Buffer is a Uint8Array view into a shared 8 KiB pool ArrayBuffer. When a remote query returns a Buffer, devalue.uneval() serialises the entire backing pool and uses .subarray(offset, end) to address the bytes. The pool contains arbitrary uninitialised data; any bytes outside the ASCII range produce U+FFFD replacement characters in the HTML, which makes the inline <script> block syntactically invalid:

Uncaught SyntaxError: illegal character U+FFFD

The page is broken on direct load / refresh. A plain Uint8Array with the same values works fine because it has its own backing ArrayBuffer.

Fix

Intercept Buffer instances in create_replacer and emit new Uint8Array([...]) from the buffer's own bytes. new Uint8Array(buffer) copies by value (not by reference into the pool), so devalue only serialises the bytes that matter.

+  if (globalThis.Buffer?.isBuffer(thing)) {
+    return `new Uint8Array([${new Uint8Array(thing)}])`;
+  }

Tests

Added packages/kit/src/runtime/server/utils.spec.js with 5 unit tests:

• serialises a regular Buffer to new Uint8Array([...])
• serialises an empty Buffer
• verifies a Buffer.allocUnsafe (pool-backed) emits only its own bytes, not the pool
• confirms the transport-encoded path is unaffected
• confirms plain Uint8Array still goes through the default devalue path

All tests pass with vitest run --config kit.vitest.config.js.

---

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
• This message body should clearly illustrates what problems it solves.
• Include a test that fails without this PR but passes with it.

Tests

• Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

• Changeset added (.changeset/fix-buffer-ssr-pool-leak.md, patch)

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from 10640b8:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/10640b80730cf82a9fc9bb427022d500cd8b600f

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/16814

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

[changeset-bot]

🦋 Changeset detected

Latest commit: 10640b8

The changes in this PR will be included in the next version bump.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

Additional Suggestions:

1. Built-in Buffer normalization short-circuits before the user transport encoder loop, silently bypassing a user-registered custom Buffer encoder

2. The SSR load-data serializer's replacer does not normalize Node.js Buffer values, so a load function returning a pooled Buffer leaks the entire 8 KiB pool ArrayBuffer into the SSR HTML and triggers illegal character U+FFFD hydration errors.

[teemingc]

Hi there. We might be solving this at the devalue layer instead sveltejs/devalue#175 can you take a look at that to see if it would solve the issue?

[okxint]

Thanks for the pointer! I looked at sveltejs/devalue#175 — the two fixes address different bugs.

What devalue#175 fixes: Buffer.toString() decodes bytes as UTF-8 instead of printing integers. Buffer.alloc(4, 65) becomes new Uint8Array([AAAA]) instead of new Uint8Array([65,65,65,65]). The fix builds the element list from the TypedArray constructor name ("Uint8Array") rather than the instance constructor (Buffer), so Array.from() iterates numeric values correctly.

What this PR fixes: Buffer.allocUnsafe (and Buffer.from/Buffer.concat on small inputs) allocates from Node's 8 KiB shared pool. The backing ArrayBuffer is the whole pool, not just the bytes you wrote. Even after devalue#175, uneval(Buffer.allocUnsafe(4)) would still emit new Uint8Array([/* 8192 values from the pool */]) — the wrong element count, not wrong element representation.

Evidence: Both problems are visible with a quick script:

import * as devalue from 'devalue';
// Even with the devalue PR applied, allocUnsafe still leaks:
const buf = Buffer.allocUnsafe(4);
buf.writeUInt32BE(0xdeadbeef, 0);
const s = devalue.uneval(buf);
console.log(s.length);     // >> 4 (with this kit PR's replacer)
                             // >> 8192 (without it, even after devalue#175)

The two fixes are complementary: devalue#175 corrects the element representation; this PR prevents the pool from being embedded in the first place. Both are needed for pooled Buffers to be safe. Happy to adjust the approach if you'd prefer the guard to live somewhere else in kit, or to close this and add a follow-up note to devalue#175 about the pool-size issue.