PR-URL: #57840

Always call uv_fs_req_cleanup after calling uv_fs_open instead of just
when uv_fs_open returns a negative result. I referenced ReadFileSync
from node:js2c when making this change.

https://github.com/bnoordhuis made the same suggestion based on the
PR #49691.

Fixes: #57800
PR-URL: #57811
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: James M Snell <[email protected]>
CVE-ID: CVE-2025-23165

Added a unit test for testing the memory usage of readFileSync.
Test is looking specifically for the the issue caused by failing
to free the filepath buffer in fs::ReadFileUtf8(), but it will also
catch other significant memory leaks in readFileSync() as well.

Refs: #57800
PR-URL: #57811
Fixes: #57800
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: James M Snell <[email protected]>

Fixes: https://hackerone.com/reports/2817648
Co-Authored-By: Filip Skokan <[email protected]>
Co-Authored-By: Tobias Nießen <[email protected]>
Backport-PR-URL: nodejs-private/node-private#688
CVE-ID: CVE-2025-23166
PR-URL: nodejs-private/node-private#709

This is a security release.

Notable changes:

src:
  * (CVE-2025-23166) fix error handling on async crypto operation
fs:
  * (CVE-2025-23165) add missing call to uv\_fs\_req\_cleanup

PR-URL: nodejs-private/node-private#712