Artifact 25988

Server-side Node.js resources are now sandboxed, and spawning workers or child processes needs add_unsafe_worker_permission or add_unsafe_child_process_permission. Lua path traversal was disabled, and the server VFS refuses non-regular files. The change first landed in 25943, was reverted in 25963 and was reapplied in 25988. Some resources had trouble around these builds.

Missing bounds checks in the connection handshake, the HTTP request parser and latent event reassembly could crash the server when it received crafted data. Anyone who can reach the server's port could trigger it. Update to 38435 or newer.

Before 37262 there was no core rate limit on netGameEvent packets. A single client could flood events such as weaponDamageEvent until the main thread hung and txAdmin restarted the server. The issue was reported on 35636 and 36727. 37262 drops clients that go over the new 'netGameEvent' rate limiter.

The server's reassembly of large client-to-server latent events got hard limits, plus diagnostics for 'latent ACK overflow'. Older builds let a client keep more partial event state than they needed to, which costs memory and CPU.

Rate limiting of latent (TriggerLatentServerEvent) traffic from clients was tightened in the reassembly packet handler. On older builds a client could push latent event traffic harder than intended.

Oversized or invalid outgoing voice messages used to hit an assertion. They are now dropped cleanly, and the send queue is drained properly. The voice server should be less likely to stall or crash under bad traffic.