A single unauthenticated UDP datagram can crash a QUIC endpoint before any handshake.

When a long-header packet carries an unsupported QUIC version, ngtcp2_pkt_decode_version_cid() returns the connection ID lengths verbatim from the single-byte length fields on the wire, it only clamps to NGTCP2_MAX_CIDLEN (20) for supported versions, so these lengths can be up to 255.

In the NGTCP2_ERR_VERSION_NEGOTIATION branch, Endpoint::Receive() built CID objects directly from those lengths before the existing CID-length check (which sits after the switch, on the supported-version path only).

A CID is backed by a fixed 20-byte ngtcp2_cid buffer, so a DCID/SCID length > 20 overruns it. Because Node does not define NDEBUG, the assert(datalen <= NGTCP2_MAX_CIDLEN) inside ngtcp2_cid_init() is compiled in and the process aborts.

Fix

Extend the CID-length policy already applied to supported-version packets to the version-negotiation branch: drop packets whose decoded connection IDs exceed NGTCP2_MAX_CIDLEN. Node's QUIC only supports v1 (CIDs ≤ 20 bytes), and the post-switch path already drops oversized-CID packets, so this is consistent with existing behavior.

Test

Adds test/parallel/test-quic-version-negotiation-oversized-cid.mjs: it sends a crafted oversized-DCID datagram via node:dgram and asserts the endpoint drops it without crashing, while a well-formed unsupported-version datagram still
produces exactly one Version Negotiation response.

Notes

• Affects only builds configured with --experimental-quic (Stability 1.0).
• The construct-before-check ordering appears identical in upstream nodejs/node — likely a latent upstream issue, not specific to this branch.