fix(tls): omit implicit SNI for absent and null servernames

src/js/node/http2.ts

@@ -5885,22 +5885,12 @@ class ClientHttp2Session extends Http2Session {
     } else {
       // Like node, https only: https://github.com/nodejs/node/blob/v26.3.0/lib/internal/http2/core.js#L3638
       if (protocol === "https:") initializeOptions(options);
-      socket = connectWithProtocol(
-        protocol,
-        options
-          ? {
-              host,
-              port: String(port),
-              ALPNProtocols: ["h2"],
-              ...options,
-            }
-          : {
-              host,
-              port: String(port),
-              ALPNProtocols: ["h2"],
-            },
-        onConnect.bind(this),
-      );
+      const connectOptions = { host, port: String(port), ALPNProtocols: ["h2"], ...options };
+      // HTTP/2 derives SNI from its authority; tls.connect itself never derives it.
+      if (protocol === "https:" && !connectOptions.servername && !net.isIP(host)) {
+        connectOptions.servername = host;
+      }
+      socket = connectWithProtocol(protocol, connectOptions, onConnect.bind(this));
       this[bunHTTP2Socket] = socket;
     }
     this.#encrypted = socket instanceof TLSSocket;

src/js/node/net.ts

@@ -1063,6 +1063,7 @@ function onClientHandshake(
   self._securePending = false;
   self._secureEstablished = true;
   self[kVerifyError] = verifyError ?? null;
+  self.servername = self.servername || false;
   self.alpnProtocol = socket.alpnProtocol;
   // Node has no try/catch around these emits; a listener throw reaches
   // InternalCallbackScope as uncaughtException. reportError mirrors that

src/js/node/tls.ts

@@ -1161,15 +1161,10 @@ TLSSocket.prototype.getX509Certificate = function getX509Certificate(this: $Node
   return this._handle?.getX509Certificate?.();
 };
 
-TLSSocket.prototype[buntls] = function (this: $Node.TLSSocket, port: unknown, host: string | null | undefined) {
+TLSSocket.prototype[buntls] = function (this: $Node.TLSSocket) {
   const ctx = this[ksecureContext];
-  // RFC 6066 forbids IP literals in SNI. Match Node.js: only default servername to host
-  // when host is not an IP. For IP hosts, pass "" so the native layer skips SNI instead of
-  // falling back to the connection host.
-  let servername = this.servername || this[kservername] || ctx?.servername;
-  if (servername === undefined) {
-    servername = host && !net.isIP(host) ? host : "";
-  }
+  // An empty native serverName suppresses its connection-host fallback; tls.connect does not infer SNI.
+  const servername = this.servername || this[kservername] || "";
   return {
     ALPNProtocols: this.ALPNProtocols,
     checkServerIdentity: this[kcheckServerIdentity],

test/js/node/tls/node-tls-connect-hostname-verification.test.ts

@@ -8,6 +8,11 @@ import net, { type AddressInfo } from "node:net";
 import path from "node:path";
 import { describe, test } from "node:test";
 import tls from "node:tls";
+import {
+  expected as expectedServername,
+  observe as observeServername,
+  cases as servernameCases,
+} from "./node-tls-servername-fixture.mjs";
 
 // Server presents a cert for CN=agent1 (no SAN), signed by ca1.
 // A client connecting to host "localhost" with ca1 trusted will pass chain
@@ -605,3 +610,12 @@ describe("Bun.connect TLS hostname verification", () => {
     }
   });
 });
+
+// The same fixture runs directly under Node.js 24.21.0.
+describe("TLS servername selection", () => {
+  for (const scenario of servernameCases) {
+    test(`${scenario.transport} host=${scenario.host} servername=${String(scenario.servername)}`, async () => {
+      assert.deepStrictEqual(await observeServername(scenario), expectedServername(scenario));
+    });
+  }
+});

test/js/node/tls/node-tls-connect.test.ts

@@ -717,6 +717,7 @@ for (const { name, connect } of tests) {
       let socket = connect({
         port: 443,
         host: "bun.sh",
+        servername: "bun.sh",
         rejectUnauthorized: false,
       });
 
@@ -736,6 +737,7 @@ for (const { name, connect } of tests) {
     // Test using port and host
     itNetwork("should process port and host correctly", done => {
       let socket = connect(443, "bun.sh", {
+        servername: "bun.sh",
         rejectUnauthorized: false,
       });
 
@@ -760,6 +762,7 @@ for (const { name, connect } of tests) {
         443,
         "bun.sh",
         {
+          servername: "bun.sh",
           rejectUnauthorized: false,
         },
         () => {
@@ -778,6 +781,7 @@ for (const { name, connect } of tests) {
     // Additional tests to ensure the callback is optional and handled correctly
     itNetwork("should handle the absence of a callback gracefully", done => {
       let socket = connect(443, "bun.sh", {
+        servername: "bun.sh",
         rejectUnauthorized: false,
       });
 
@@ -803,6 +807,7 @@ for (const { name, connect } of tests) {
           {
             port: 443,
             host: "bun.sh",
+            servername: "bun.sh",
           },
           () => {
             socket.setTimeout(1000, () => {