From 2f715eefdc93cec534b474f1bbf33930a478571a Mon Sep 17 00:00:00 2001
From: dhruv7539 <dhruvbhanderi7@gmail.com>
Date: Tue, 24 Feb 2026 17:07:00 -0800
Subject: [PATCH] src: validate stdio entries in process_wrap

---
 src/process_wrap.cc                           |  6 ++++
 ...st-child-process-array-prototype-setter.js | 29 +++++++++++++++++++
 2 files changed, 35 insertions(+)
 create mode 100644 test/parallel/test-child-process-array-prototype-setter.js

diff --git a/src/process_wrap.cc b/src/process_wrap.cc
index d27ca7da7b587b..c4e5911689f019 100644
--- a/src/process_wrap.cc
+++ b/src/process_wrap.cc
@@ -140,6 +140,12 @@ class ProcessWrap : public HandleWrap {
       if (!stdios->Get(context, i).ToLocal(&val)) {
         return Nothing<void>();
       }
+      if (!val->IsObject()) {
+        THROW_ERR_INVALID_ARG_TYPE(env,
+                                   "options.stdio[%u] must be an object",
+                                   i);
+        return Nothing<void>();
+      }
       Local<Object> stdio = val.As<Object>();
       Local<Value> type;
       if (!stdio->Get(context, env->type_string()).ToLocal(&type)) {
diff --git a/test/parallel/test-child-process-array-prototype-setter.js b/test/parallel/test-child-process-array-prototype-setter.js
new file mode 100644
index 00000000000000..043869a8700d5f
--- /dev/null
+++ b/test/parallel/test-child-process-array-prototype-setter.js
@@ -0,0 +1,29 @@
+'use strict';
+require('../common');
+
+const assert = require('assert');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+const script = `
+Object.defineProperty(Array.prototype, '2', {
+  __proto__: null,
+  set() {},
+  configurable: true,
+});
+
+try {
+  require('child_process').spawn(process.execPath, ['-e', '0']);
+  console.log('NO_ERROR');
+} catch (error) {
+  console.log(error.code);
+}
+`;
+
+spawnSyncAndAssert(process.execPath, ['-e', script], {
+  stdout: (output) => {
+    assert.match(output, /^ERR_INVALID_ARG_TYPE\\r?\\n$/);
+  },
+  stderr: (output) => {
+    assert.doesNotMatch(output, /FATAL ERROR: v8::ToLocalChecked Empty MaybeLocal/);
+  },
+});