From 650b51aa117f714d1949475b87b35fff06968163 Mon Sep 17 00:00:00 2001
From: Helmi Pradita <50313181+helmipradita@users.noreply.github.com>
Date: Fri, 30 Oct 2026 13:38:08 +0700
Subject: [PATCH] src,util: strip leading UTF-8 BOM in parseEnv

Fixes: https://github.com/nodejs/node/issues/67102

Files starting with a UTF-8 Byte Order Mark (\xEF\xBB\xBF) are common on
Windows. Previously, Dotenv::ParseContent did not strip a leading BOM,
leaving it attached to the first key and corrupting process.env access.

Strip a leading UTF-8 BOM if present at the beginning of content and add
a test case in test-util-parse-env.js.

Signed-off-by: Helmi Pradita <50313181+helmipradita@users.noreply.github.com>
---
 src/node_dotenv.cc                   | 6 ++++++
 test/parallel/test-util-parse-env.js | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/src/node_dotenv.cc b/src/node_dotenv.cc
index 0c6fa30a41d7..6e07460dac02 100644
--- a/src/node_dotenv.cc
+++ b/src/node_dotenv.cc
@@ -151,6 +151,12 @@ void Dotenv::ParseContent(const std::string_view input) {
   lines.erase(std::remove(lines.begin(), lines.end(), '\r'), lines.end());
 
   std::string_view content = lines;
+
+  // Strip leading UTF-8 Byte Order Mark (BOM) if present
+  if (content.rfind("\xEF\xBB\xBF", 0) == 0) {
+    content = content.substr(3);
+  }
+
   content = trim_spaces(content);
 
   std::string_view key;
diff --git a/test/parallel/test-util-parse-env.js b/test/parallel/test-util-parse-env.js
index e932a31f683e..e110cf5aed84 100644
--- a/test/parallel/test-util-parse-env.js
+++ b/test/parallel/test-util-parse-env.js
@@ -65,6 +65,8 @@ const fs = require('node:fs');
 assert.deepStrictEqual(util.parseEnv(''), { __proto__: null });
 assert.deepStrictEqual(util.parseEnv('FOO=bar\nFOO=baz\n'),
                        { __proto__: null, FOO: 'baz' });
+assert.deepStrictEqual(util.parseEnv('\uFEFFA=1\r\nB=2\r\n'),
+                       { __proto__: null, A: '1', B: '2' });
 
 // Test for invalid input.
 assert.throws(() => {