node-libcurl crashes accidentally on insecure request to host with bad ssl cert

Hello. I want to make insecure request (ignore any problems with ssl certificates). But script crashes accidentally. Here is a script:

const { Curl, CurlFeature } = require('node-libcurl');

const curl = new Curl()
const url = 'https://expired.badssl.com/'

console.log(Curl.getVersionInfoString())
console.log(Curl.VERSION_NUM)

curl.setOpt('URL', url)

// or use an already defined constant
// curl.setOpt(Curl.option.CONNECTTIMEOUT, 5)
curl.setOpt(Curl.option.FOLLOWLOCATION, true)
curl.setOpt(Curl.option.SSL_VERIFYHOST, false)
curl.setOpt(Curl.option.SSL_VERIFYPEER, false);
curl.setOpt(Curl.option.CUSTOMREQUEST, 'GET');
curl.setOpt(Curl.option.VERBOSE, true);


curl.on('end', (statusCode, body, headers, curlInstance) => {
  curl.close()
})

// Error will be a JS error, errorCode will be the raw error code (as int) returned from libcurl
curl.on('error', (error, errorCode) => {
  curl.close()
})

// this triggers the request
curl.perform()

// It's async, so it does not block the Node.js thread
console.log('I will show before the request starts')

Here is a output.

Version: libcurl/7.64.1 OpenSSL/1.1.0j zlib/1.2.11 brotli/1.0.7 libidn2/2.1.1 libssh2/1.9.0 nghttp2/1.39.2
Protocols: dict, file, ftp, ftps, gopher, http, https, imap, imaps, ldap, ldaps, pop3, pop3s, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp
Features: AsynchDNS, IDN, IPv6, Largefile, NTLM, NTLM_WB, SSL, libz, brotli, TLS-SRP, HTTP2, UnixSockets, HTTPS-proxy
475137
I will show before the request starts
*   Trying 104.154.89.105...
* TCP_NODELAY set
* Connected to expired.badssl.com (104.154.89.105) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: OU=Domain Control Validated; OU=PositiveSSL Wildcard; CN=*.badssl.com
*  start date: Apr  9 00:00:00 2015 GMT
*  expire date: Apr 12 23:59:59 2015 GMT
*  issuer: C=GB; ST=Greater Manchester; L=Salford; O=COMODO CA Limited; CN=COMODO RSA Domain Validation Secure Server CA
*  SSL certificate verify result: certificate has expired (10), continuing anyway.
> GET / HTTP/1.1
Host: expired.badssl.com
User-Agent: node-libcurl/2.0.3
Accept: */*

< HTTP/1.1 200 OK
< Server: nginx/1.10.3 (Ubuntu)
< Date: Mon, 16 Mar 2020 04:59:59 GMT
< Content-Type: text/html
< Content-Length: 494
< Last-Modified: Wed, 22 Jan 2020 16:30:37 GMT
< Connection: keep-alive
< ETag: "5e2878ad-1ee"
< Cache-Control: no-store
< Accept-Ranges: bytes
free(): invalid next size (fast)
[1]    9130 abort      node strict-ssl-bug.js

[JCMais]

I’m closing this as v2.1.0 (see the release page for full changelog) has been finally released. 🎉

[JCMais]

This probably was an issue with libcurl itself, seems to be fixed on the prerelease version available at node-libcurl@next, which uses libcurl 7.69.1, this version will be released as 2.1.0 next week.