Current 14.x
Pairs the native-ESM Node.js package for Node 22.13+ with the dependency-free Rust crate for Rust 1.85+. The normal framed wire contract is shared; language-specific transport boundaries remain explicit.
Trust is application-owned
Security
Select protocol containment once, minimize who can reach the endpoint, verify peer identity, authorize every command, and validate application payloads.
Runtime boundary.
The node-ipc JavaScript package is Node.js-only. It does not run in web browsers, whether bundled or unbundled, because browser-targeted bundling cannot provide its raw TCP, TLS, UDP, local-socket, filesystem, OS, process, or Buffer contracts.
Release lanes
Legacy 12.x
Supports Node.js 14+. Review its published package, documented contract, and advisories as a distinct deployment lane. Version 13 was never published.
Never combine lane claims.
A 14.x option or test does not retroactively describe version 12. Pin the exact release and evaluate the relevant Node.js or Rust contract.
Transport boundaries
| Transport | What it provides | What the application still owns |
|---|---|---|
| Unix socket / Windows pipe | Host-local reachability controlled partly by operating-system permissions | Message identity, authorization, validation, and safe endpoint ownership |
| TCP | Ordered, reliable delivery | Confidentiality, peer identity, authorization, and payload validation |
| TLS | Encryption and the identities actually verified by its certificate policy | Correct trust roots, hostname checking, client identity, authorization, rotation, and payload validation |
| UDP | Independent datagrams | Identity, confidentiality, delivery recovery, ordering, replay handling, validation, and rate limits |
Node.js protocol containment profiles
| Profile | Verified built-in boundary | Application requirements |
|---|---|---|
| Raw | No node-ipc parsing or validation. | Own framing, size, content, identity, authorization, and abuse controls. |
| Fast | Malformed JSON closes a stream connection or resets UDP peer frame state. | Use only with trusted peers; it does not apply Guarded envelope, name, size, timeout, or backpressure controls. |
| Guarded | Object envelopes, bounded frames and stream writes, safe event names, reserved-name policy, and incomplete-frame timeout. | Authenticate peers, validate payload schemas, authorize actions, control rates, and monitor failures. |
| Assured | Guarded plus a required event allow-list; network clients require key/cert/trusted CA verification, servers require verified client certificates, and each Unix local server endpoint must be a direct child of the secure socket root. Clients must verify local endpoint ownership. Windows local is rejected because node-ipc cannot prove the pipe ACL. | Authorize the verified certificate identity, validate payload policy, manage keys and trust roots, audit, rate-limit, and harden operations. |
Selection is not polled per message.
Set the parser, limits, TLS, logging, and compatibility options before endpoint construction. Restart the endpoint to change the policy. identifyPeer=true restores legacy data.id lookup, but that caller-supplied value is never authenticated identity.
The profile names are engineering contracts, not government, military, industry, compliance, or security certifications. See the selection guide and custom parser contract.
Rust transport boundary
Rust exposes the same Raw, Fast, Guarded, and Assured profile names and framed wire contract. Guarded and Assured use a per-frame write ceiling because Rust writes synchronously; they do not measure Node.js-style queued socket writes. Rust Assured adds the required event allow-list, but it cannot authenticate an arbitrary Read + Write transport.
- Supply and verify mutual TLS for hostile networks.
- Enforce an owner-only parent and client-side endpoint ownership for Assured Unix sockets.
- Create and verify the required Windows named-pipe ACL outside the crate.
- Do not use UDP with Rust Assured; the crate rejects it.
Application checklist
Minimize reach
- Prefer local sockets on one machine.
- Keep network binds on loopback by default.
- Expose only the required interface and port.
Establish identity
- Verify TLS server certificates and hostnames.
- Use mutual TLS or application credentials for clients.
- Never trust a payload id as identity.
Authorize + validate
- Map verified identity to allowed actions.
- Validate payload type, shape, size, and semantics.
- Make sensitive commands replay-aware.
Control resources
- Select Guarded/Assured limits before construction.
- Add connection and rate budgets.
- Verify cleanup under failure.
Protect secrets
- Keep keys outside package and source trees.
- Leave payload logging off by default.
- Redact tokens, keys, and passphrases.
Verify evidence
- Read the exact named tests.
- Confirm generated pass/fail results.
- Inspect coverage, benchmarks, and platform CI.
TLS minimums
- Supply certificates appropriate to the service and deployment environment.
- Keep
rejectUnauthorizedenabled and set the expected server name when connecting by IP. - Use a narrowly trusted CA set.
- Require and authorize client identity when the service is not public.
- Test untrusted CA, hostname mismatch, expiry, missing client certificate, and rotation before claiming those boundaries.
Library tests and deployment checks have different jobs.
The node-ipc suite verifies encrypted transport and framed TLS round trips. Certificate issuance, hostname policy, trust-root selection, mutual authentication, rotation, and deployment-specific failure drills remain operator checks in the environment where the service runs.
Report a vulnerability
Do not open a public issue for an undisclosed vulnerability. Follow the repository security policy and provide the affected version or commit, reproduction, impact, and suggested mitigation when available.