Commit 52bfcaf5720 for nodejs

commit 52bfcaf5720022dda48964ec8aab237a80351b25
Author: Lazizbek Ergashev <lazerg2@gmail.com>
Date:   Sat Nov 14 13:07:22 2026 +0500

    tls: pop errors from failed session parsing

    Signed-off-by: lazerg <lazerg2@gmail.com>
    PR-URL: https://github.com/nodejs/node/pull/67212
    Fixes: https://github.com/nodejs/node/issues/67204
    Reviewed-By: Tim Perry <pimterry@gmail.com>
    Reviewed-By: James M Snell <jasnell@gmail.com>

diff --git a/src/crypto/crypto_common.cc b/src/crypto/crypto_common.cc
index 759353f08f0..630606b3c7a 100644
--- a/src/crypto/crypto_common.cc
+++ b/src/crypto/crypto_common.cc
@@ -30,6 +30,7 @@ namespace node {
 using ncrypto::ClearErrorOnReturn;
 using ncrypto::EVPKeyPointer;
 using ncrypto::KeyAlgorithm;
+using ncrypto::MarkPopErrorOnReturn;
 using ncrypto::SSLPointer;
 using ncrypto::SSLSessionPointer;
 using ncrypto::StackOfX509;
@@ -49,6 +50,7 @@ using v8::Value;
 namespace crypto {

 SSLSessionPointer GetTLSSession(const unsigned char* buf, size_t length) {
+  MarkPopErrorOnReturn mark_pop_error_on_return;
   return SSLSessionPointer(d2i_SSL_SESSION(nullptr, &buf, length));
 }

diff --git a/test/parallel/test-tls-socket-invalid-session.js b/test/parallel/test-tls-socket-invalid-session.js
new file mode 100644
index 00000000000..09685ef745a
--- /dev/null
+++ b/test/parallel/test-tls-socket-invalid-session.js
@@ -0,0 +1,27 @@
+'use strict';
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const crypto = require('crypto');
+const tls = require('tls');
+
+// A session that fails to deserialize must not leave an error on the OpenSSL
+// error queue for the next unrelated crypto operation to pick up.
+
+const badKey = '-----BEGIN PRIVATE KEY-----\nAAAA\n-----END PRIVATE KEY-----';
+
+function keyErrorCode() {
+  try {
+    crypto.createPrivateKey(badKey);
+  } catch (err) {
+    return err.code;
+  }
+  assert.fail('createPrivateKey() should have thrown');
+}
+
+const expected = keyErrorCode();
+new tls.TLSSocket(null, { session: Buffer.from('invalid session') });
+assert.strictEqual(keyErrorCode(), expected);