From 4efe1c7eaf13b077031b9067a1189559abc612e6 Mon Sep 17 00:00:00 2001
From: dansatch <dansatch98@gmail.com>
Date: Sun, 8 Nov 2026 17:50:35 +0000
Subject: [PATCH] url: validate href setter receiver first

Validate the URL receiver before converting the assigned href value.

Fixes: https://github.com/nodejs/node/issues/67344
Signed-off-by: dansatch <dansatch98@gmail.com>
---
 lib/internal/url.js                              |  3 ++-
 .../test-whatwg-url-custom-href-side-effect.js   | 16 ++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/lib/internal/url.js b/lib/internal/url.js
index 0fe819fe129c..2d1339702b96 100644
--- a/lib/internal/url.js
+++ b/lib/internal/url.js
@@ -1022,8 +1022,9 @@ class URL {
   }
 
   set href(value) {
+    const context = this.#context;
     value = `${value}`;
-    const href = bindingUrl.update(this.#context.href, updateActions.kHref, value);
+    const href = bindingUrl.update(context.href, updateActions.kHref, value);
     if (!href) { throw new ERR_INVALID_URL(value); }
     this.#updateContext(href, true);
   }
diff --git a/test/parallel/test-whatwg-url-custom-href-side-effect.js b/test/parallel/test-whatwg-url-custom-href-side-effect.js
index 30967d9feaef..daecb2a2226f 100644
--- a/test/parallel/test-whatwg-url-custom-href-side-effect.js
+++ b/test/parallel/test-whatwg-url-custom-href-side-effect.js
@@ -13,3 +13,19 @@ assert.throws(() => {
 });
 
 assert.deepStrictEqual(url, ref);
+
+const setHref = Object.getOwnPropertyDescriptor(URL.prototype, 'href').set;
+let calls = 0;
+
+assert.throws(() => {
+  setHref.call({}, {
+    toString() {
+      calls++;
+      return 'https://example.com/';
+    },
+  });
+}, {
+  name: 'TypeError',
+});
+
+assert.strictEqual(calls, 0);