diff --git a/doc/api/errors.md b/doc/api/errors.md
index a98571edd61942..3079e2031d7a9f 100644
--- a/doc/api/errors.md
+++ b/doc/api/errors.md
@@ -1566,6 +1566,17 @@ behavior. See the documentation for [policy][] manifests for more information.
 An attempt was made to allocate memory (usually in the C++ layer) but it
 failed.
 
+<a id="ERR_MESSAGE_TARGET_CONTEXT_UNAVAILABLE"></a>
+### `ERR_MESSAGE_TARGET_CONTEXT_UNAVAILABLE`
+<!-- YAML
+added: REPLACEME
+-->
+
+A message posted to a [`MessagePort`][] could not be deserialized in the target
+[vm][] `Context`. Not all Node.js objects can be successfully instantiated in
+any context at this time, and attempting to transfer them using `postMessage()`
+can fail on the receiving side in that case.
+
 <a id="ERR_METHOD_NOT_IMPLEMENTED"></a>
 ### `ERR_METHOD_NOT_IMPLEMENTED`
 
@@ -1589,8 +1600,9 @@ is thrown if a required option is missing.
 <a id="ERR_MISSING_MESSAGE_PORT_IN_TRANSFER_LIST"></a>
 ### `ERR_MISSING_MESSAGE_PORT_IN_TRANSFER_LIST`
 
-A `MessagePort` was found in the object passed to a `postMessage()` call,
-but not provided in the `transferList` for that call.
+An object that needs to be explicitly listed in the `transferList` argument
+was found in the object passed to a `postMessage()` call, but not provided in
+the `transferList` for that call. Usually, this is a `MessagePort`.
 
 <a id="ERR_MISSING_PASSPHRASE"></a>
 ### `ERR_MISSING_PASSPHRASE`
@@ -2563,6 +2575,7 @@ such as `process.stdout.on('data')`.
 [`Class: assert.AssertionError`]: assert.html#assert_class_assert_assertionerror
 [`ERR_INVALID_ARG_TYPE`]: #ERR_INVALID_ARG_TYPE
 [`EventEmitter`]: events.html#events_class_eventemitter
+[`MessagePort`]: worker_threads.html#worker_threads_class_messageport
 [`Object.getPrototypeOf`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/getPrototypeOf
 [`Object.setPrototypeOf`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/setPrototypeOf
 [`REPL`]: repl.html
diff --git a/doc/api/worker_threads.md b/doc/api/worker_threads.md
index d4fd2f5179a3c1..702abca0a01dd9 100644
--- a/doc/api/worker_threads.md
+++ b/doc/api/worker_threads.md
@@ -303,6 +303,15 @@ input of [`port.postMessage()`][].
 Listeners on this event will receive a clone of the `value` parameter as passed
 to `postMessage()` and no further arguments.
 
+### Event: `'messageerror'`
+<!-- YAML
+added: REPLACEME
+-->
+
+* `error` {Error} An Error object
+
+The `'messageerror'` event is emitted when deserializing a message failed.
+
 ### `port.close()`
 <!-- YAML
 added: v10.5.0
@@ -318,6 +327,10 @@ are part of the channel.
 ### `port.postMessage(value[, transferList])`
 <!-- YAML
 added: v10.5.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/33772
+    description: Added `FileHandle` to the list of transferable types.
 -->
 
 * `value` {any}
@@ -335,7 +348,8 @@ In particular, the significant differences to `JSON` are:
 * `value` may contain typed arrays, both using `ArrayBuffer`s
    and `SharedArrayBuffer`s.
 * `value` may contain [`WebAssembly.Module`][] instances.
-* `value` may not contain native (C++-backed) objects other than `MessagePort`s.
+* `value` may not contain native (C++-backed) objects other than `MessagePort`s
+  and [`FileHandle`][]s.
 
 ```js
 const { MessageChannel } = require('worker_threads');
@@ -349,7 +363,8 @@ circularData.foo = circularData;
 port2.postMessage(circularData);
 ```
 
-`transferList` may be a list of `ArrayBuffer` and `MessagePort` objects.
+`transferList` may be a list of [`ArrayBuffer`][], [`MessagePort`][] and
+[`FileHandle`][] objects.
 After transferring, they will not be usable on the sending side of the channel
 anymore (even if they are not contained in `value`). Unlike with
 [child processes][], transferring handles such as network sockets is currently
@@ -675,6 +690,15 @@ See the [`port.on('message')`][] event for more details.
 All messages sent from the worker thread will be emitted before the
 [`'exit'` event][] is emitted on the `Worker` object.
 
+### Event: `'messageerror'`
+<!-- YAML
+added: REPLACEME
+-->
+
+* `error` {Error} An Error object
+
+The `'messageerror'` event is emitted when deserializing a message failed.
+
 ### Event: `'online'`
 <!-- YAML
 added: v10.5.0
@@ -816,6 +840,7 @@ active handle in the event system. If the worker is already `unref()`ed calling
 
 [`'close'` event]: #worker_threads_event_close
 [`'exit'` event]: #worker_threads_event_exit
+[`ArrayBuffer`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/ArrayBuffer
 [`AsyncResource`]: async_hooks.html#async_hooks_class_asyncresource
 [`Buffer`]: buffer.html
 [`Buffer.allocUnsafe()`]: buffer.html#buffer_class_method_buffer_allocunsafe_size
@@ -823,6 +848,7 @@ active handle in the event system. If the worker is already `unref()`ed calling
 [`ERR_WORKER_NOT_RUNNING`]: errors.html#ERR_WORKER_NOT_RUNNING
 [`EventEmitter`]: events.html
 [`EventTarget`]: https://developer.mozilla.org/en-US/docs/Web/API/EventTarget
+[`FileHandle`]: fs.html#fs_class_filehandle
 [`MessagePort`]: #worker_threads_class_messageport
 [`SharedArrayBuffer`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer
 [`Uint8Array`]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array
diff --git a/lib/internal/bootstrap/node.js b/lib/internal/bootstrap/node.js
index 522faf779f446b..92dc2a6cc7d2d6 100644
--- a/lib/internal/bootstrap/node.js
+++ b/lib/internal/bootstrap/node.js
@@ -58,6 +58,7 @@ process._exiting = false;
 
 // process.config is serialized config.gypi
 process.config = JSONParse(internalBinding('native_module').config);
+require('internal/worker/js_transferable').setup();
 
 // Bootstrappers for all threads, including worker threads and main thread
 const perThreadSetup = require('internal/process/per_thread');
diff --git a/lib/internal/fs/promises.js b/lib/internal/fs/promises.js
index 05d82991552bad..717b26e59fa3b4 100644
--- a/lib/internal/fs/promises.js
+++ b/lib/internal/fs/promises.js
@@ -65,13 +65,17 @@ const { promisify } = require('internal/util');
 const kHandle = Symbol('kHandle');
 const kFd = Symbol('kFd');
 const { kUsePromises } = binding;
+const {
+  JSTransferable, kDeserialize, kTransfer, kTransferList
+} = require('internal/worker/js_transferable');
 
 const getDirectoryEntriesPromise = promisify(getDirents);
 
-class FileHandle {
+class FileHandle extends JSTransferable {
   constructor(filehandle) {
+    super();
     this[kHandle] = filehandle;
-    this[kFd] = filehandle.fd;
+    this[kFd] = filehandle ? filehandle.fd : -1;
   }
 
   getAsyncId() {
@@ -142,6 +146,26 @@ class FileHandle {
     this[kFd] = -1;
     return this[kHandle].close();
   }
+
+  [kTransfer]() {
+    const handle = this[kHandle];
+    this[kFd] = -1;
+    this[kHandle] = null;
+
+    return {
+      data: { handle },
+      deserializeInfo: 'internal/fs/promises:FileHandle'
+    };
+  }
+
+  [kTransferList]() {
+    return [ this[kHandle] ];
+  }
+
+  [kDeserialize]({ handle }) {
+    this[kHandle] = handle;
+    this[kFd] = handle.fd;
+  }
 }
 
 function validateFileHandle(handle) {
diff --git a/lib/internal/worker.js b/lib/internal/worker.js
index ff405c11157597..de005cc9fa4611 100644
--- a/lib/internal/worker.js
+++ b/lib/internal/worker.js
@@ -192,7 +192,9 @@ class Worker extends EventEmitter {
       transferList.push(...options.transferList);
 
     this[kPublicPort] = port1;
-    this[kPublicPort].on('message', (message) => this.emit('message', message));
+    for (const event of ['message', 'messageerror']) {
+      this[kPublicPort].on(event, (message) => this.emit(event, message));
+    }
     setupPortReferencing(this[kPublicPort], this, 'message');
     this[kPort].postMessage({
       argv,
diff --git a/lib/internal/worker/js_transferable.js b/lib/internal/worker/js_transferable.js
new file mode 100644
index 00000000000000..707fd03f2f6d0e
--- /dev/null
+++ b/lib/internal/worker/js_transferable.js
@@ -0,0 +1,39 @@
+'use strict';
+const { Error } = primordials;
+const {
+  messaging_deserialize_symbol,
+  messaging_transfer_symbol,
+  messaging_clone_symbol,
+  messaging_transfer_list_symbol
+} = internalBinding('symbols');
+const {
+  JSTransferable,
+  setDeserializerCreateObjectFunction
+} = internalBinding('messaging');
+
+function setup() {
+  // Register the handler that will be used when deserializing JS-based objects
+  // from .postMessage() calls. The format of `deserializeInfo` is generally
+  // 'module:Constructor', e.g. 'internal/fs/promises:FileHandle'.
+  setDeserializerCreateObjectFunction((deserializeInfo) => {
+    const [ module, ctor ] = deserializeInfo.split(':');
+    const Ctor = require(module)[ctor];
+    if (typeof Ctor !== 'function' ||
+        !(Ctor.prototype instanceof JSTransferable)) {
+      // Not one of the official errors because one should not be able to get
+      // here without messing with Node.js internals.
+      // eslint-disable-next-line no-restricted-syntax
+      throw new Error(`Unknown deserialize spec ${deserializeInfo}`);
+    }
+    return new Ctor();
+  });
+}
+
+module.exports = {
+  setup,
+  JSTransferable,
+  kClone: messaging_clone_symbol,
+  kDeserialize: messaging_deserialize_symbol,
+  kTransfer: messaging_transfer_symbol,
+  kTransferList: messaging_transfer_list_symbol
+};
diff --git a/node.gyp b/node.gyp
index 1ebb8c2cc978e6..37af98ba424cf3 100644
--- a/node.gyp
+++ b/node.gyp
@@ -220,6 +220,7 @@
       'lib/internal/vm/module.js',
       'lib/internal/worker.js',
       'lib/internal/worker/io.js',
+      'lib/internal/worker/js_transferable.js',
       'lib/internal/watchdog.js',
       'lib/internal/streams/lazy_transform.js',
       'lib/internal/streams/async_iterator.js',
diff --git a/src/async_wrap.cc b/src/async_wrap.cc
index 13c2c3ca5a5ec3..80342b78284892 100644
--- a/src/async_wrap.cc
+++ b/src/async_wrap.cc
@@ -557,6 +557,7 @@ Local<FunctionTemplate> AsyncWrap::GetConstructorTemplate(Environment* env) {
   if (tmpl.IsEmpty()) {
     tmpl = env->NewFunctionTemplate(nullptr);
     tmpl->SetClassName(FIXED_ONE_BYTE_STRING(env->isolate(), "AsyncWrap"));
+    tmpl->Inherit(BaseObject::GetConstructorTemplate(env));
     env->SetProtoMethod(tmpl, "getAsyncId", AsyncWrap::GetAsyncId);
     env->SetProtoMethod(tmpl, "asyncReset", AsyncWrap::AsyncReset);
     env->SetProtoMethod(tmpl, "getProviderType", AsyncWrap::GetProviderType);
diff --git a/src/base_object-inl.h b/src/base_object-inl.h
index f6e980e8749f61..555063f4e23e67 100644
--- a/src/base_object-inl.h
+++ b/src/base_object-inl.h
@@ -156,6 +156,7 @@ BaseObject::MakeLazilyInitializedJSTemplate(Environment* env) {
   };
 
   v8::Local<v8::FunctionTemplate> t = env->NewFunctionTemplate(constructor);
+  t->Inherit(BaseObject::GetConstructorTemplate(env));
   t->InstanceTemplate()->SetInternalFieldCount(
       BaseObject::kInternalFieldCount);
   return t;
@@ -337,6 +338,20 @@ BaseObjectPtrImpl<T, kIsWeak>::operator bool() const {
   return get() != nullptr;
 }
 
+template <typename T, bool kIsWeak>
+template <typename U, bool kW>
+bool BaseObjectPtrImpl<T, kIsWeak>::operator ==(
+    const BaseObjectPtrImpl<U, kW>& other) const {
+  return get() == other.get();
+}
+
+template <typename T, bool kIsWeak>
+template <typename U, bool kW>
+bool BaseObjectPtrImpl<T, kIsWeak>::operator !=(
+    const BaseObjectPtrImpl<U, kW>& other) const {
+  return get() != other.get();
+}
+
 template <typename T, typename... Args>
 BaseObjectPtr<T> MakeBaseObject(Args&&... args) {
   return BaseObjectPtr<T>(new T(std::forward<Args>(args)...));
diff --git a/src/base_object.h b/src/base_object.h
index 674eae1f0f7766..61e5d0cff97174 100644
--- a/src/base_object.h
+++ b/src/base_object.h
@@ -34,6 +34,10 @@ class Environment;
 template <typename T, bool kIsWeak>
 class BaseObjectPtrImpl;
 
+namespace worker {
+class TransferData;
+}
+
 class BaseObject : public MemoryRetainer {
  public:
   enum InternalFields { kSlot, kInternalFieldCount };
@@ -98,7 +102,51 @@ class BaseObject : public MemoryRetainer {
   // a BaseObjectPtr to this object.
   inline void Detach();
 
- protected:
+  static v8::Local<v8::FunctionTemplate> GetConstructorTemplate(
+      Environment* env);
+
+  // Interface for transferring BaseObject instances using the .postMessage()
+  // method of MessagePorts (and, by extension, Workers).
+  // GetTransferMode() returns a transfer mode that indicates how to deal with
+  // the current object:
+  // - kUntransferable:
+  //     No transfer is possible, either because this type of BaseObject does
+  //     not know how to be transfered, or because it is not in a state in
+  //     which it is possible to do so (e.g. because it has already been
+  //     transfered).
+  // - kTransferable:
+  //     This object can be transfered in a destructive fashion, i.e. will be
+  //     rendered unusable on the sending side of the channel in the process
+  //     of being transfered. (In C++ this would be referred to as movable but
+  //     not copyable.) Objects of this type need to be listed in the
+  //     `transferList` argument of the relevant postMessage() call in order to
+  //     make sure that they are not accidentally destroyed on the sending side.
+  //     TransferForMessaging() will be called to get a representation of the
+  //     object that is used for subsequent deserialization.
+  //     The NestedTransferables() method can be used to transfer other objects
+  //     along with this one, if a situation requires it.
+  // - kCloneable:
+  //     This object can be cloned without being modified.
+  //     CloneForMessaging() will be called to get a representation of the
+  //     object that is used for subsequent deserialization, unless the
+  //     object is listed in transferList, in which case TransferForMessaging()
+  //     is attempted first.
+  // After a successful clone, FinalizeTransferRead() is called on the receiving
+  // end, and can read deserialize JS data possibly serialized by a previous
+  // FinalizeTransferWrite() call.
+  enum class TransferMode {
+    kUntransferable,
+    kTransferable,
+    kCloneable
+  };
+  virtual TransferMode GetTransferMode() const;
+  virtual std::unique_ptr<worker::TransferData> TransferForMessaging();
+  virtual std::unique_ptr<worker::TransferData> CloneForMessaging() const;
+  virtual v8::Maybe<std::vector<BaseObjectPtrImpl<BaseObject, false>>>
+      NestedTransferables() const;
+  virtual v8::Maybe<bool> FinalizeTransferRead(
+      v8::Local<v8::Context> context, v8::ValueDeserializer* deserializer);
+
   virtual inline void OnGCCollect();
 
  private:
@@ -197,6 +245,11 @@ class BaseObjectPtrImpl final {
   inline T* operator->() const;
   inline operator bool() const;
 
+  template <typename U, bool kW>
+  inline bool operator ==(const BaseObjectPtrImpl<U, kW>& other) const;
+  template <typename U, bool kW>
+  inline bool operator !=(const BaseObjectPtrImpl<U, kW>& other) const;
+
  private:
   union {
     BaseObject* target;  // Used for strong pointers.
diff --git a/src/env.cc b/src/env.cc
index 677faf093a8c1f..4030df9ec90f57 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -269,6 +269,7 @@ void Environment::CreateProperties() {
     Local<FunctionTemplate> templ = FunctionTemplate::New(isolate());
     templ->InstanceTemplate()->SetInternalFieldCount(
         BaseObject::kInternalFieldCount);
+    templ->Inherit(BaseObject::GetConstructorTemplate(this));
 
     set_binding_data_ctor_template(templ);
   }
@@ -1112,4 +1113,14 @@ bool BaseObject::IsRootNode() const {
   return !persistent_handle_.IsWeak();
 }
 
+Local<FunctionTemplate> BaseObject::GetConstructorTemplate(Environment* env) {
+  Local<FunctionTemplate> tmpl = env->base_object_ctor_template();
+  if (tmpl.IsEmpty()) {
+    tmpl = env->NewFunctionTemplate(nullptr);
+    tmpl->SetClassName(FIXED_ONE_BYTE_STRING(env->isolate(), "BaseObject"));
+    env->set_base_object_ctor_template(tmpl);
+  }
+  return tmpl;
+}
+
 }  // namespace node
diff --git a/src/env.h b/src/env.h
index 4b8670de46a8c2..60fb2575dc0972 100644
--- a/src/env.h
+++ b/src/env.h
@@ -159,6 +159,10 @@ constexpr size_t kFsStatsBufferLength =
   V(async_id_symbol, "async_id_symbol")                                        \
   V(handle_onclose_symbol, "handle_onclose")                                   \
   V(no_message_symbol, "no_message_symbol")                                    \
+  V(messaging_deserialize_symbol, "messaging_deserialize_symbol")              \
+  V(messaging_transfer_symbol, "messaging_transfer_symbol")                    \
+  V(messaging_clone_symbol, "messaging_clone_symbol")                          \
+  V(messaging_transfer_list_symbol, "messaging_transfer_list_symbol")          \
   V(oninit_symbol, "oninit")                                                   \
   V(owner_symbol, "owner_symbol")                                              \
   V(onpskexchange_symbol, "onpskexchange")                                     \
@@ -201,6 +205,7 @@ constexpr size_t kFsStatsBufferLength =
   V(crypto_rsa_pss_string, "rsa-pss")                                          \
   V(cwd_string, "cwd")                                                         \
   V(data_string, "data")                                                       \
+  V(deserialize_info_string, "deserializeInfo")                                \
   V(dest_string, "dest")                                                       \
   V(destroyed_string, "destroyed")                                             \
   V(detached_string, "detached")                                               \
@@ -218,6 +223,7 @@ constexpr size_t kFsStatsBufferLength =
   V(done_string, "done")                                                       \
   V(duration_string, "duration")                                               \
   V(ecdh_string, "ECDH")                                                       \
+  V(emit_string, "emit")                                                       \
   V(emit_warning_string, "emitWarning")                                        \
   V(empty_object_string, "{}")                                                 \
   V(encoding_string, "encoding")                                               \
@@ -274,6 +280,7 @@ constexpr size_t kFsStatsBufferLength =
   V(message_port_constructor_string, "MessagePort")                            \
   V(message_port_string, "messagePort")                                        \
   V(message_string, "message")                                                 \
+  V(messageerror_string, "messageerror")                                       \
   V(minttl_string, "minttl")                                                   \
   V(module_string, "module")                                                   \
   V(modulus_string, "modulus")                                                 \
@@ -395,6 +402,7 @@ constexpr size_t kFsStatsBufferLength =
 #define ENVIRONMENT_STRONG_PERSISTENT_TEMPLATES(V)                             \
   V(async_wrap_ctor_template, v8::FunctionTemplate)                            \
   V(async_wrap_object_ctor_template, v8::FunctionTemplate)                     \
+  V(base_object_ctor_template, v8::FunctionTemplate)                           \
   V(binding_data_ctor_template, v8::FunctionTemplate)                          \
   V(compiled_fn_entry_template, v8::ObjectTemplate)                            \
   V(dir_instance_template, v8::ObjectTemplate)                                 \
@@ -452,6 +460,7 @@ constexpr size_t kFsStatsBufferLength =
   V(internal_binding_loader, v8::Function)                                     \
   V(immediate_callback_function, v8::Function)                                 \
   V(inspector_console_extension_installer, v8::Function)                       \
+  V(messaging_deserialize_create_object, v8::Function)                         \
   V(message_port, v8::Object)                                                  \
   V(native_module_require, v8::Function)                                       \
   V(performance_entry_callback, v8::Function)                                  \
diff --git a/src/module_wrap.cc b/src/module_wrap.cc
index ab8dbc9cbf7fa5..05f8b8ad762135 100644
--- a/src/module_wrap.cc
+++ b/src/module_wrap.cc
@@ -699,6 +699,7 @@ void ModuleWrap::Initialize(Local<Object> target,
   tpl->SetClassName(FIXED_ONE_BYTE_STRING(isolate, "ModuleWrap"));
   tpl->InstanceTemplate()->SetInternalFieldCount(
       ModuleWrap::kInternalFieldCount);
+  tpl->Inherit(BaseObject::GetConstructorTemplate(env));
 
   env->SetProtoMethod(tpl, "link", Link);
   env->SetProtoMethod(tpl, "instantiate", Instantiate);
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index 360732e37fd514..ca394f2e24e4bb 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -455,6 +455,7 @@ void SecureContext::Initialize(Environment* env, Local<Object> target) {
   Local<FunctionTemplate> t = env->NewFunctionTemplate(New);
   t->InstanceTemplate()->SetInternalFieldCount(
       SecureContext::kInternalFieldCount);
+  t->Inherit(BaseObject::GetConstructorTemplate(env));
   Local<String> secureContextString =
       FIXED_ONE_BYTE_STRING(env->isolate(), "SecureContext");
   t->SetClassName(secureContextString);
@@ -3246,6 +3247,7 @@ Local<Function> KeyObject::Initialize(Environment* env, Local<Object> target) {
   Local<FunctionTemplate> t = env->NewFunctionTemplate(New);
   t->InstanceTemplate()->SetInternalFieldCount(
       KeyObject::kInternalFieldCount);
+  t->Inherit(BaseObject::GetConstructorTemplate(env));
 
   env->SetProtoMethod(t, "init", Init);
   env->SetProtoMethodNoSideEffect(t, "getSymmetricKeySize",
@@ -3480,6 +3482,7 @@ void CipherBase::Initialize(Environment* env, Local<Object> target) {
 
   t->InstanceTemplate()->SetInternalFieldCount(
       CipherBase::kInternalFieldCount);
+  t->Inherit(BaseObject::GetConstructorTemplate(env));
 
   env->SetProtoMethod(t, "init", Init);
   env->SetProtoMethod(t, "initiv", InitIv);
@@ -4095,6 +4098,7 @@ void Hmac::Initialize(Environment* env, Local<Object> target) {
 
   t->InstanceTemplate()->SetInternalFieldCount(
       Hmac::kInternalFieldCount);
+  t->Inherit(BaseObject::GetConstructorTemplate(env));
 
   env->SetProtoMethod(t, "init", HmacInit);
   env->SetProtoMethod(t, "update", HmacUpdate);
@@ -4207,6 +4211,7 @@ void Hash::Initialize(Environment* env, Local<Object> target) {
 
   t->InstanceTemplate()->SetInternalFieldCount(
       Hash::kInternalFieldCount);
+  t->Inherit(BaseObject::GetConstructorTemplate(env));
 
   env->SetProtoMethod(t, "update", HashUpdate);
   env->SetProtoMethod(t, "digest", HashDigest);
@@ -4463,6 +4468,7 @@ void Sign::Initialize(Environment* env, Local<Object> target) {
 
   t->InstanceTemplate()->SetInternalFieldCount(
       SignBase::kInternalFieldCount);
+  t->Inherit(BaseObject::GetConstructorTemplate(env));
 
   env->SetProtoMethod(t, "init", SignInit);
   env->SetProtoMethod(t, "update", SignUpdate);
@@ -4785,6 +4791,7 @@ void Verify::Initialize(Environment* env, Local<Object> target) {
 
   t->InstanceTemplate()->SetInternalFieldCount(
       SignBase::kInternalFieldCount);
+  t->Inherit(BaseObject::GetConstructorTemplate(env));
 
   env->SetProtoMethod(t, "init", VerifyInit);
   env->SetProtoMethod(t, "update", VerifyUpdate);
@@ -5095,6 +5102,7 @@ void DiffieHellman::Initialize(Environment* env, Local<Object> target) {
 
     t->InstanceTemplate()->SetInternalFieldCount(
         DiffieHellman::kInternalFieldCount);
+    t->Inherit(BaseObject::GetConstructorTemplate(env));
 
     env->SetProtoMethod(t, "generateKeys", GenerateKeys);
     env->SetProtoMethod(t, "computeSecret", ComputeSecret);
@@ -5454,6 +5462,7 @@ void ECDH::Initialize(Environment* env, Local<Object> target) {
   HandleScope scope(env->isolate());
 
   Local<FunctionTemplate> t = env->NewFunctionTemplate(New);
+  t->Inherit(BaseObject::GetConstructorTemplate(env));
 
   t->InstanceTemplate()->SetInternalFieldCount(ECDH::kInternalFieldCount);
 
diff --git a/src/node_errors.h b/src/node_errors.h
index 01a8d8e75ac99a..b9f001d777bb07 100644
--- a/src/node_errors.h
+++ b/src/node_errors.h
@@ -41,6 +41,7 @@ void OnFatalError(const char* location, const char* message);
   V(ERR_INVALID_ARG_TYPE, TypeError)                                           \
   V(ERR_INVALID_TRANSFER_OBJECT, TypeError)                                    \
   V(ERR_MEMORY_ALLOCATION_FAILED, Error)                                       \
+  V(ERR_MESSAGE_TARGET_CONTEXT_UNAVAILABLE, Error)                             \
   V(ERR_MISSING_ARGS, TypeError)                                               \
   V(ERR_MISSING_MESSAGE_PORT_IN_TRANSFER_LIST, TypeError)                      \
   V(ERR_MISSING_PASSPHRASE, TypeError)                                         \
@@ -92,8 +93,12 @@ void OnFatalError(const char* location, const char* message);
   V(ERR_INVALID_TRANSFER_OBJECT, "Found invalid object in transferList")       \
   V(ERR_MEMORY_ALLOCATION_FAILED, "Failed to allocate memory")                 \
   V(ERR_OSSL_EVP_INVALID_DIGEST, "Invalid digest used")                        \
+  V(ERR_MESSAGE_TARGET_CONTEXT_UNAVAILABLE,                                    \
+    "A message object could not be deserialized successfully in the target "   \
+    "vm.Context")                                                              \
   V(ERR_MISSING_MESSAGE_PORT_IN_TRANSFER_LIST,                                 \
-    "MessagePort was found in message but not listed in transferList")         \
+    "Object that needs transfer was found in message but not listed "          \
+    "in transferList")                                                         \
   V(ERR_MISSING_PLATFORM_FOR_WORKER,                                           \
     "The V8 platform used by this instance of Node does not support "          \
     "creating Workers")                                                        \
diff --git a/src/node_file.cc b/src/node_file.cc
index c2ed56f43fb0ae..9ed2d2960cf95e 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -190,6 +190,40 @@ void FileHandle::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TrackField("current_read", current_read_);
 }
 
+FileHandle::TransferMode FileHandle::GetTransferMode() const {
+  return reading_ || closing_ || closed_ ?
+      TransferMode::kUntransferable : TransferMode::kTransferable;
+}
+
+std::unique_ptr<worker::TransferData> FileHandle::TransferForMessaging() {
+  CHECK_NE(GetTransferMode(), TransferMode::kUntransferable);
+  auto ret = std::make_unique<TransferData>(fd_);
+  closed_ = true;
+  return ret;
+}
+
+FileHandle::TransferData::TransferData(int fd) : fd_(fd) {}
+
+FileHandle::TransferData::~TransferData() {
+  if (fd_ > 0) {
+    uv_fs_t close_req;
+    CHECK_EQ(0, uv_fs_close(nullptr, &close_req, fd_, nullptr));
+    uv_fs_req_cleanup(&close_req);
+  }
+}
+
+BaseObjectPtr<BaseObject> FileHandle::TransferData::Deserialize(
+    Environment* env,
+    v8::Local<v8::Context> context,
+    std::unique_ptr<worker::TransferData> self) {
+  BindingData* bd = Environment::GetBindingData<BindingData>(context);
+  if (bd == nullptr) return {};
+
+  int fd = fd_;
+  fd_ = -1;
+  return BaseObjectPtr<BaseObject> { FileHandle::New(bd, fd) };
+}
+
 // Close the file descriptor if it hasn't already been closed. A process
 // warning will be emitted using a SetImmediate to avoid calling back to
 // JS during GC. If closing the fd fails at this point, a fatal exception
diff --git a/src/node_file.h b/src/node_file.h
index ad493bd944c20c..fd17fc99d52aba 100644
--- a/src/node_file.h
+++ b/src/node_file.h
@@ -5,6 +5,7 @@
 
 #include "node.h"
 #include "aliased_buffer.h"
+#include "node_messaging.h"
 #include "stream_base.h"
 #include <iostream>
 
@@ -273,7 +274,28 @@ class FileHandle final : public AsyncWrap, public StreamBase {
   FileHandle(const FileHandle&&) = delete;
   FileHandle& operator=(const FileHandle&&) = delete;
 
+  TransferMode GetTransferMode() const override;
+  std::unique_ptr<worker::TransferData> TransferForMessaging() override;
+
  private:
+  class TransferData : public worker::TransferData {
+   public:
+    explicit TransferData(int fd);
+    ~TransferData();
+
+    BaseObjectPtr<BaseObject> Deserialize(
+        Environment* env,
+        v8::Local<v8::Context> context,
+        std::unique_ptr<worker::TransferData> self) override;
+
+    SET_NO_MEMORY_INFO()
+    SET_MEMORY_INFO_NAME(FileHandleTransferData)
+    SET_SELF_SIZE(TransferData)
+
+   private:
+    int fd_;
+  };
+
   FileHandle(BindingData* binding_data, v8::Local<v8::Object> obj, int fd);
 
   // Synchronous close that emits a warning
diff --git a/src/node_i18n.cc b/src/node_i18n.cc
index 169374aa5de441..5382e469a4087c 100644
--- a/src/node_i18n.cc
+++ b/src/node_i18n.cc
@@ -811,6 +811,7 @@ void Initialize(Local<Object> target,
   // ConverterObject
   {
     Local<FunctionTemplate> t = FunctionTemplate::New(env->isolate());
+    t->Inherit(BaseObject::GetConstructorTemplate(env));
     t->InstanceTemplate()->SetInternalFieldCount(
         ConverterObject::kInternalFieldCount);
     Local<String> converter_string =
diff --git a/src/node_messaging.cc b/src/node_messaging.cc
index ffe29a5dea8c8a..22d2ff7257234a 100644
--- a/src/node_messaging.cc
+++ b/src/node_messaging.cc
@@ -10,6 +10,7 @@
 #include "util-inl.h"
 
 using node::contextify::ContextifyContext;
+using node::errors::TryCatchScope;
 using v8::Array;
 using v8::ArrayBuffer;
 using v8::BackingStore;
@@ -37,8 +38,37 @@ using v8::ValueSerializer;
 using v8::WasmModuleObject;
 
 namespace node {
+
+using BaseObjectList = std::vector<BaseObjectPtr<BaseObject>>;
+
+BaseObject::TransferMode BaseObject::GetTransferMode() const {
+  return BaseObject::TransferMode::kUntransferable;
+}
+
+std::unique_ptr<worker::TransferData> BaseObject::TransferForMessaging() {
+  return CloneForMessaging();
+}
+
+std::unique_ptr<worker::TransferData> BaseObject::CloneForMessaging() const {
+  return {};
+}
+
+Maybe<BaseObjectList> BaseObject::NestedTransferables() const {
+  return Just(BaseObjectList {});
+}
+
+Maybe<bool> BaseObject::FinalizeTransferRead(
+    Local<Context> context, ValueDeserializer* deserializer) {
+  return Just(true);
+}
+
 namespace worker {
 
+Maybe<bool> TransferData::FinalizeTransferWrite(
+    Local<Context> context, ValueSerializer* serializer) {
+  return Just(true);
+}
+
 Message::Message(MallocedBuffer<char>&& buffer)
     : main_message_buf_(std::move(buffer)) {}
 
@@ -55,21 +85,20 @@ class DeserializerDelegate : public ValueDeserializer::Delegate {
   DeserializerDelegate(
       Message* m,
       Environment* env,
-      const std::vector<MessagePort*>& message_ports,
+      const std::vector<BaseObjectPtr<BaseObject>>& host_objects,
       const std::vector<Local<SharedArrayBuffer>>& shared_array_buffers,
       const std::vector<CompiledWasmModule>& wasm_modules)
-      : message_ports_(message_ports),
+      : host_objects_(host_objects),
         shared_array_buffers_(shared_array_buffers),
         wasm_modules_(wasm_modules) {}
 
   MaybeLocal<Object> ReadHostObject(Isolate* isolate) override {
-    // Currently, only MessagePort hosts objects are supported, so identifying
-    // by the index in the message's MessagePort array is sufficient.
+    // Identifying the index in the message's BaseObject array is sufficient.
     uint32_t id;
     if (!deserializer->ReadUint32(&id))
       return MaybeLocal<Object>();
-    CHECK_LE(id, message_ports_.size());
-    return message_ports_[id]->object(isolate);
+    CHECK_LE(id, host_objects_.size());
+    return host_objects_[id]->object(isolate);
   }
 
   MaybeLocal<SharedArrayBuffer> GetSharedArrayBufferFromId(
@@ -88,7 +117,7 @@ class DeserializerDelegate : public ValueDeserializer::Delegate {
   ValueDeserializer* deserializer = nullptr;
 
  private:
-  const std::vector<MessagePort*>& message_ports_;
+  const std::vector<BaseObjectPtr<BaseObject>>& host_objects_;
   const std::vector<Local<SharedArrayBuffer>>& shared_array_buffers_;
   const std::vector<CompiledWasmModule>& wasm_modules_;
 };
@@ -102,22 +131,26 @@ MaybeLocal<Value> Message::Deserialize(Environment* env,
   EscapableHandleScope handle_scope(env->isolate());
   Context::Scope context_scope(context);
 
-  // Create all necessary MessagePort handles.
-  std::vector<MessagePort*> ports(message_ports_.size());
-  for (uint32_t i = 0; i < message_ports_.size(); ++i) {
-    ports[i] = MessagePort::New(env,
-                                context,
-                                std::move(message_ports_[i]));
-    if (ports[i] == nullptr) {
-      for (MessagePort* port : ports) {
-        // This will eventually release the MessagePort object itself.
-        if (port != nullptr)
-          port->Close();
-      }
-      return MaybeLocal<Value>();
+  // Create all necessary objects for transferables, e.g. MessagePort handles.
+  std::vector<BaseObjectPtr<BaseObject>> host_objects(transferables_.size());
+  auto cleanup = OnScopeLeave([&]() {
+    for (BaseObjectPtr<BaseObject> object : host_objects) {
+      if (!object) continue;
+
+      // If the function did not finish successfully, host_objects will contain
+      // a list of objects that will never be passed to JS. Therefore, we
+      // destroy them here.
+      object->Detach();
     }
+  });
+
+  for (uint32_t i = 0; i < transferables_.size(); ++i) {
+    TransferData* data = transferables_[i].get();
+    host_objects[i] = data->Deserialize(
+        env, context, std::move(transferables_[i]));
+    if (!host_objects[i]) return {};
   }
-  message_ports_.clear();
+  transferables_.clear();
 
   std::vector<Local<SharedArrayBuffer>> shared_array_buffers;
   // Attach all transferred SharedArrayBuffers to their new Isolate.
@@ -130,7 +163,7 @@ MaybeLocal<Value> Message::Deserialize(Environment* env,
   shared_array_buffers_.clear();
 
   DeserializerDelegate delegate(
-      this, env, ports, shared_array_buffers, wasm_modules_);
+      this, env, host_objects, shared_array_buffers, wasm_modules_);
   ValueDeserializer deserializer(
       env->isolate(),
       reinterpret_cast<const uint8_t*>(main_message_buf_.data),
@@ -147,9 +180,18 @@ MaybeLocal<Value> Message::Deserialize(Environment* env,
   array_buffers_.clear();
 
   if (deserializer.ReadHeader(context).IsNothing())
-    return MaybeLocal<Value>();
-  return handle_scope.Escape(
-      deserializer.ReadValue(context).FromMaybe(Local<Value>()));
+    return {};
+  Local<Value> return_value;
+  if (!deserializer.ReadValue(context).ToLocal(&return_value))
+    return {};
+
+  for (BaseObjectPtr<BaseObject> base_object : host_objects) {
+    if (base_object->FinalizeTransferRead(context, &deserializer).IsNothing())
+      return {};
+  }
+
+  host_objects.clear();
+  return handle_scope.Escape(return_value);
 }
 
 void Message::AddSharedArrayBuffer(
@@ -157,8 +199,8 @@ void Message::AddSharedArrayBuffer(
   shared_array_buffers_.emplace_back(std::move(backing_store));
 }
 
-void Message::AddMessagePort(std::unique_ptr<MessagePortData>&& data) {
-  message_ports_.emplace_back(std::move(data));
+void Message::AddTransferable(std::unique_ptr<TransferData>&& data) {
+  transferables_.emplace_back(std::move(data));
 }
 
 uint32_t Message::AddWASMModule(CompiledWasmModule&& mod) {
@@ -224,8 +266,9 @@ class SerializerDelegate : public ValueSerializer::Delegate {
   }
 
   Maybe<bool> WriteHostObject(Isolate* isolate, Local<Object> object) override {
-    if (env_->message_port_constructor_template()->HasInstance(object)) {
-      return WriteMessagePort(Unwrap<MessagePort>(object));
+    if (env_->base_object_ctor_template()->HasInstance(object)) {
+      return WriteHostObject(
+          BaseObjectPtr<BaseObject> { Unwrap<BaseObject>(object) });
     }
 
     ThrowDataCloneError(env_->clone_unsupported_type_str());
@@ -254,35 +297,84 @@ class SerializerDelegate : public ValueSerializer::Delegate {
     return Just(msg_->AddWASMModule(module->GetCompiledModule()));
   }
 
-  void Finish() {
-    // Only close the MessagePort handles and actually transfer them
-    // once we know that serialization succeeded.
-    for (MessagePort* port : ports_) {
-      port->Close();
-      msg_->AddMessagePort(port->Detach());
+  Maybe<bool> Finish(Local<Context> context) {
+    for (uint32_t i = 0; i < host_objects_.size(); i++) {
+      BaseObjectPtr<BaseObject> host_object = std::move(host_objects_[i]);
+      std::unique_ptr<TransferData> data;
+      if (i < first_cloned_object_index_)
+        data = host_object->TransferForMessaging();
+      if (!data)
+        data = host_object->CloneForMessaging();
+      if (!data) return Nothing<bool>();
+      if (data->FinalizeTransferWrite(context, serializer).IsNothing())
+        return Nothing<bool>();
+      msg_->AddTransferable(std::move(data));
     }
+    return Just(true);
+  }
+
+  inline void AddHostObject(BaseObjectPtr<BaseObject> host_object) {
+    // Make sure we have not started serializing the value itself yet.
+    CHECK_EQ(first_cloned_object_index_, SIZE_MAX);
+    host_objects_.emplace_back(std::move(host_object));
+  }
+
+  // Some objects in the transfer list may register sub-objects that can be
+  // transferred. This could e.g. be a public JS wrapper object, such as a
+  // FileHandle, that is registering its C++ handle for transfer.
+  inline Maybe<bool> AddNestedHostObjects() {
+    for (size_t i = 0; i < host_objects_.size(); i++) {
+      std::vector<BaseObjectPtr<BaseObject>> nested_transferables;
+      if (!host_objects_[i]->NestedTransferables().To(&nested_transferables))
+        return Nothing<bool>();
+      for (auto nested_transferable : nested_transferables) {
+        if (std::find(host_objects_.begin(),
+                      host_objects_.end(),
+                      nested_transferable) == host_objects_.end()) {
+          AddHostObject(nested_transferable);
+        }
+      }
+    }
+    return Just(true);
   }
 
   ValueSerializer* serializer = nullptr;
 
  private:
-  Maybe<bool> WriteMessagePort(MessagePort* port) {
-    for (uint32_t i = 0; i < ports_.size(); i++) {
-      if (ports_[i] == port) {
+  Maybe<bool> WriteHostObject(BaseObjectPtr<BaseObject> host_object) {
+    for (uint32_t i = 0; i < host_objects_.size(); i++) {
+      if (host_objects_[i] == host_object) {
         serializer->WriteUint32(i);
         return Just(true);
       }
     }
 
-    THROW_ERR_MISSING_MESSAGE_PORT_IN_TRANSFER_LIST(env_);
-    return Nothing<bool>();
+    BaseObject::TransferMode mode = host_object->GetTransferMode();
+    if (mode == BaseObject::TransferMode::kUntransferable) {
+      ThrowDataCloneError(env_->clone_unsupported_type_str());
+      return Nothing<bool>();
+    } else if (mode == BaseObject::TransferMode::kTransferable) {
+      // TODO(addaleax): This message code is too specific. Fix that in a
+      // semver-major follow-up.
+      THROW_ERR_MISSING_MESSAGE_PORT_IN_TRANSFER_LIST(env_);
+      return Nothing<bool>();
+    }
+
+    CHECK_EQ(mode, BaseObject::TransferMode::kCloneable);
+    uint32_t index = host_objects_.size();
+    if (first_cloned_object_index_ == SIZE_MAX)
+      first_cloned_object_index_ = index;
+    serializer->WriteUint32(index);
+    host_objects_.push_back(host_object);
+    return Just(true);
   }
 
   Environment* env_;
   Local<Context> context_;
   Message* msg_;
   std::vector<Global<SharedArrayBuffer>> seen_shared_array_buffers_;
-  std::vector<MessagePort*> ports_;
+  std::vector<BaseObjectPtr<BaseObject>> host_objects_;
+  size_t first_cloned_object_index_ = SIZE_MAX;
 
   friend class worker::Message;
 };
@@ -344,8 +436,7 @@ Maybe<bool> Message::Serialize(Environment* env,
       array_buffers.push_back(ab);
       serializer.TransferArrayBuffer(id, ab);
       continue;
-    } else if (env->message_port_constructor_template()
-                  ->HasInstance(entry)) {
+    } else if (env->base_object_ctor_template()->HasInstance(entry)) {
       // Check if the source MessagePort is being transferred.
       if (!source_port.IsEmpty() && entry == source_port) {
         ThrowDataCloneException(
@@ -354,8 +445,11 @@ Maybe<bool> Message::Serialize(Environment* env,
                                   "Transfer list contains source port"));
         return Nothing<bool>();
       }
-      MessagePort* port = Unwrap<MessagePort>(entry.As<Object>());
-      if (port == nullptr || port->IsDetached()) {
+      BaseObjectPtr<BaseObject> host_object {
+          Unwrap<BaseObject>(entry.As<Object>()) };
+      if (env->message_port_constructor_template()->HasInstance(entry) &&
+          (!host_object ||
+           static_cast<MessagePort*>(host_object.get())->IsDetached())) {
         ThrowDataCloneException(
             context,
             FIXED_ONE_BYTE_STRING(
@@ -363,22 +457,30 @@ Maybe<bool> Message::Serialize(Environment* env,
                 "MessagePort in transfer list is already detached"));
         return Nothing<bool>();
       }
-      if (std::find(delegate.ports_.begin(), delegate.ports_.end(), port) !=
-          delegate.ports_.end()) {
+      if (std::find(delegate.host_objects_.begin(),
+                    delegate.host_objects_.end(),
+                    host_object) != delegate.host_objects_.end()) {
         ThrowDataCloneException(
             context,
-            FIXED_ONE_BYTE_STRING(
-                env->isolate(),
-                "Transfer list contains duplicate MessagePort"));
+            String::Concat(env->isolate(),
+                FIXED_ONE_BYTE_STRING(
+                  env->isolate(),
+                  "Transfer list contains duplicate "),
+                entry.As<Object>()->GetConstructorName()));
         return Nothing<bool>();
       }
-      delegate.ports_.push_back(port);
-      continue;
+      if (host_object && host_object->GetTransferMode() !=
+              BaseObject::TransferMode::kUntransferable) {
+        delegate.AddHostObject(host_object);
+        continue;
+      }
     }
 
     THROW_ERR_INVALID_TRANSFER_OBJECT(env);
     return Nothing<bool>();
   }
+  if (delegate.AddNestedHostObjects().IsNothing())
+    return Nothing<bool>();
 
   serializer.WriteHeader();
   if (serializer.WriteValue(context, input).IsNothing()) {
@@ -393,7 +495,8 @@ Maybe<bool> Message::Serialize(Environment* env,
     array_buffers_.emplace_back(std::move(backing_store));
   }
 
-  delegate.Finish();
+  if (delegate.Finish(context).IsNothing())
+    return Nothing<bool>();
 
   // The serializer gave us a buffer allocated using `malloc()`.
   std::pair<uint8_t*, size_t> data = serializer.Release();
@@ -406,7 +509,7 @@ Maybe<bool> Message::Serialize(Environment* env,
 void Message::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TrackField("array_buffers_", array_buffers_);
   tracker->TrackField("shared_array_buffers", shared_array_buffers_);
-  tracker->TrackField("message_ports", message_ports_);
+  tracker->TrackField("transferables", transferables_);
 }
 
 MessagePortData::MessagePortData(MessagePort* owner) : owner_(owner) { }
@@ -636,9 +739,20 @@ void MessagePort::OnMessage() {
 
     HandleScope handle_scope(env()->isolate());
     Context::Scope context_scope(context);
+    Local<Function> emit_message = PersistentToLocal::Strong(emit_message_fn_);
 
     Local<Value> payload;
-    if (!ReceiveMessage(context, true).ToLocal(&payload)) break;
+    Local<Value> message_error;
+    {
+      // Catch any exceptions from parsing the message itself (not from
+      // emitting it) as 'messageeror' events.
+      TryCatchScope try_catch(env());
+      if (!ReceiveMessage(context, true).ToLocal(&payload)) {
+        if (try_catch.HasCaught() && !try_catch.HasTerminated())
+          message_error = try_catch.Exception();
+        goto reschedule;
+      }
+    }
     if (payload == env()->no_message_symbol()) break;
 
     if (!env()->can_call_into_js()) {
@@ -647,8 +761,18 @@ void MessagePort::OnMessage() {
       continue;
     }
 
-    Local<Function> emit_message = PersistentToLocal::Strong(emit_message_fn_);
     if (MakeCallback(emit_message, 1, &payload).IsEmpty()) {
+    reschedule:
+      if (!message_error.IsEmpty()) {
+        // This should become a `messageerror` event in the sense of the
+        // EventTarget API at some point.
+        Local<Value> argv[] = {
+          env()->messageerror_string(),
+          message_error
+        };
+        USE(MakeCallback(env()->emit_string(), arraysize(argv), argv));
+      }
+
       // Re-schedule OnMessage() execution in case of failure.
       if (data_)
         TriggerAsync();
@@ -672,6 +796,25 @@ std::unique_ptr<MessagePortData> MessagePort::Detach() {
   return std::move(data_);
 }
 
+BaseObject::TransferMode MessagePort::GetTransferMode() const {
+  if (IsDetached())
+    return BaseObject::TransferMode::kUntransferable;
+  return BaseObject::TransferMode::kTransferable;
+}
+
+std::unique_ptr<TransferData> MessagePort::TransferForMessaging() {
+  Close();
+  return Detach();
+}
+
+BaseObjectPtr<BaseObject> MessagePortData::Deserialize(
+    Environment* env,
+    Local<Context> context,
+    std::unique_ptr<TransferData> self) {
+  return BaseObjectPtr<MessagePort> { MessagePort::New(
+      env, context,
+      static_unique_pointer_cast<MessagePortData>(std::move(self))) };
+}
 
 Maybe<bool> MessagePort::PostMessage(Environment* env,
                                      Local<Value> message_v,
@@ -699,8 +842,8 @@ Maybe<bool> MessagePort::PostMessage(Environment* env,
 
   // Check if the target port is posted to itself.
   if (data_->sibling_ != nullptr) {
-    for (const auto& port_data : msg.message_ports()) {
-      if (data_->sibling_ == port_data.get()) {
+    for (const auto& transferable : msg.transferables()) {
+      if (data_->sibling_ == transferable.get()) {
         doomed = true;
         ProcessEmitWarning(env, "The target port was posted to itself, and "
                                 "the communication channel was lost");
@@ -947,8 +1090,186 @@ Local<FunctionTemplate> GetMessagePortConstructorTemplate(Environment* env) {
   return GetMessagePortConstructorTemplate(env);
 }
 
+JSTransferable::JSTransferable(Environment* env, Local<Object> obj)
+    : BaseObject(env, obj) {
+  MakeWeak();
+}
+
+void JSTransferable::New(const FunctionCallbackInfo<Value>& args) {
+  CHECK(args.IsConstructCall());
+  new JSTransferable(Environment::GetCurrent(args), args.This());
+}
+
+JSTransferable::TransferMode JSTransferable::GetTransferMode() const {
+  // Implement `kClone in this ? kCloneable : kTransferable`.
+  HandleScope handle_scope(env()->isolate());
+  errors::TryCatchScope ignore_exceptions(env());
+
+  bool has_clone;
+  if (!object()->Has(env()->context(),
+                     env()->messaging_clone_symbol()).To(&has_clone)) {
+    return TransferMode::kUntransferable;
+  }
+
+  return has_clone ? TransferMode::kCloneable : TransferMode::kTransferable;
+}
+
+std::unique_ptr<TransferData> JSTransferable::TransferForMessaging() {
+  return TransferOrClone(TransferMode::kTransferable);
+}
+
+std::unique_ptr<TransferData> JSTransferable::CloneForMessaging() const {
+  return TransferOrClone(TransferMode::kCloneable);
+}
+
+std::unique_ptr<TransferData> JSTransferable::TransferOrClone(
+    TransferMode mode) const {
+  // Call `this[symbol]()` where `symbol` is `kClone` or `kTransfer`,
+  // which should return an object with `data` and `deserializeInfo` properties;
+  // `data` is written to the serializer later, and `deserializeInfo` is stored
+  // on the `TransferData` instance as a string.
+  HandleScope handle_scope(env()->isolate());
+  Local<Context> context = env()->isolate()->GetCurrentContext();
+  Local<Symbol> method_name = mode == TransferMode::kCloneable ?
+      env()->messaging_clone_symbol() : env()->messaging_transfer_symbol();
+
+  Local<Value> method;
+  if (!object()->Get(context, method_name).ToLocal(&method)) {
+    return {};
+  }
+  if (method->IsFunction()) {
+    Local<Value> result_v;
+    if (!method.As<Function>()->Call(
+            context, object(), 0, nullptr).ToLocal(&result_v)) {
+      return {};
+    }
+
+    if (result_v->IsObject()) {
+      Local<Object> result = result_v.As<Object>();
+      Local<Value> data;
+      Local<Value> deserialize_info;
+      if (!result->Get(context, env()->data_string()).ToLocal(&data) ||
+          !result->Get(context, env()->deserialize_info_string())
+              .ToLocal(&deserialize_info)) {
+        return {};
+      }
+      Utf8Value deserialize_info_str(env()->isolate(), deserialize_info);
+      if (*deserialize_info_str == nullptr) return {};
+      return std::make_unique<Data>(
+          *deserialize_info_str, Global<Value>(env()->isolate(), data));
+    }
+  }
+
+  if (mode == TransferMode::kTransferable)
+    return TransferOrClone(TransferMode::kCloneable);
+  else
+    return {};
+}
+
+Maybe<BaseObjectList>
+JSTransferable::NestedTransferables() const {
+  // Call `this[kTransferList]()` and return the resulting list of BaseObjects.
+  HandleScope handle_scope(env()->isolate());
+  Local<Context> context = env()->isolate()->GetCurrentContext();
+  Local<Symbol> method_name = env()->messaging_transfer_list_symbol();
+
+  Local<Value> method;
+  if (!object()->Get(context, method_name).ToLocal(&method)) {
+    return Nothing<BaseObjectList>();
+  }
+  if (!method->IsFunction()) return Just(BaseObjectList {});
+
+  Local<Value> list_v;
+  if (!method.As<Function>()->Call(
+          context, object(), 0, nullptr).ToLocal(&list_v)) {
+    return Nothing<BaseObjectList>();
+  }
+  if (!list_v->IsArray()) return Just(BaseObjectList {});
+  Local<Array> list = list_v.As<Array>();
+
+  BaseObjectList ret;
+  for (size_t i = 0; i < list->Length(); i++) {
+    Local<Value> value;
+    if (!list->Get(context, i).ToLocal(&value))
+      return Nothing<BaseObjectList>();
+    if (env()->base_object_ctor_template()->HasInstance(value))
+      ret.emplace_back(Unwrap<BaseObject>(value));
+  }
+  return Just(ret);
+}
+
+Maybe<bool> JSTransferable::FinalizeTransferRead(
+    Local<Context> context, ValueDeserializer* deserializer) {
+  // Call `this[kDeserialize](data)` where `data` comes from the return value
+  // of `this[kTransfer]()` or `this[kClone]()`.
+  HandleScope handle_scope(env()->isolate());
+  Local<Value> data;
+  if (!deserializer->ReadValue(context).ToLocal(&data)) return Nothing<bool>();
+
+  Local<Symbol> method_name = env()->messaging_deserialize_symbol();
+  Local<Value> method;
+  if (!object()->Get(context, method_name).ToLocal(&method)) {
+    return Nothing<bool>();
+  }
+  if (!method->IsFunction()) return Just(true);
+
+  if (method.As<Function>()->Call(context, object(), 1, &data).IsEmpty()) {
+    return Nothing<bool>();
+  }
+  return Just(true);
+}
+
+JSTransferable::Data::Data(std::string&& deserialize_info,
+                           v8::Global<v8::Value>&& data)
+    : deserialize_info_(std::move(deserialize_info)),
+      data_(std::move(data)) {}
+
+BaseObjectPtr<BaseObject> JSTransferable::Data::Deserialize(
+    Environment* env,
+    Local<Context> context,
+    std::unique_ptr<TransferData> self) {
+  // Create the JS wrapper object that will later be filled with data passed to
+  // the `[kDeserialize]()` method on it. This split is necessary, because here
+  // we need to create an object with the right prototype and internal fields,
+  // but the actual JS data stored in the serialized data can only be read at
+  // the end of the stream, after the main message has been read.
+
+  if (context != env->context()) {
+    THROW_ERR_MESSAGE_TARGET_CONTEXT_UNAVAILABLE(env);
+    return {};
+  }
+  HandleScope handle_scope(env->isolate());
+  Local<Value> info;
+  if (!ToV8Value(context, deserialize_info_).ToLocal(&info)) return {};
+
+  Local<Value> ret;
+  CHECK(!env->messaging_deserialize_create_object().IsEmpty());
+  if (!env->messaging_deserialize_create_object()->Call(
+          context, Null(env->isolate()), 1, &info).ToLocal(&ret) ||
+      !env->base_object_ctor_template()->HasInstance(ret)) {
+    return {};
+  }
+
+  return BaseObjectPtr<BaseObject> { Unwrap<BaseObject>(ret) };
+}
+
+Maybe<bool> JSTransferable::Data::FinalizeTransferWrite(
+    Local<Context> context, ValueSerializer* serializer) {
+  HandleScope handle_scope(context->GetIsolate());
+  auto ret = serializer->WriteValue(context, PersistentToLocal::Strong(data_));
+  data_.Reset();
+  return ret;
+}
+
 namespace {
 
+static void SetDeserializerCreateObjectFunction(
+    const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK(args[0]->IsFunction());
+  env->set_messaging_deserialize_create_object(args[0].As<Function>());
+}
+
 static void MessageChannel(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   if (!args.IsConstructCall()) {
@@ -991,6 +1312,19 @@ static void InitMessaging(Local<Object> target,
                 templ->GetFunction(context).ToLocalChecked()).Check();
   }
 
+  {
+    Local<String> js_transferable_string =
+        FIXED_ONE_BYTE_STRING(env->isolate(), "JSTransferable");
+    Local<FunctionTemplate> t = env->NewFunctionTemplate(JSTransferable::New);
+    t->Inherit(BaseObject::GetConstructorTemplate(env));
+    t->SetClassName(js_transferable_string);
+    t->InstanceTemplate()->SetInternalFieldCount(
+        JSTransferable::kInternalFieldCount);
+    target->Set(context,
+                js_transferable_string,
+                t->GetFunction(context).ToLocalChecked()).Check();
+  }
+
   target->Set(context,
               env->message_port_constructor_string(),
               GetMessagePortConstructorTemplate(env)
@@ -1003,6 +1337,8 @@ static void InitMessaging(Local<Object> target,
   env->SetMethod(target, "receiveMessageOnPort", MessagePort::ReceiveMessage);
   env->SetMethod(target, "moveMessagePortToContext",
                  MessagePort::MoveToContext);
+  env->SetMethod(target, "setDeserializerCreateObjectFunction",
+                 SetDeserializerCreateObjectFunction);
 
   {
     Local<Function> domexception = GetDOMException(context).ToLocalChecked();
diff --git a/src/node_messaging.h b/src/node_messaging.h
index d687e7549d51e9..378468b6f44465 100644
--- a/src/node_messaging.h
+++ b/src/node_messaging.h
@@ -15,6 +15,29 @@ class MessagePort;
 
 typedef MaybeStackBuffer<v8::Local<v8::Value>, 8> TransferList;
 
+// Used to represent the in-flight structure of an object that is being
+// transfered or cloned using postMessage().
+class TransferData : public MemoryRetainer {
+ public:
+  // Deserialize this object on the receiving end after a .postMessage() call.
+  // - `context` may not be the same as `env->context()`. This method should
+  //    not produce JS objects coming from Contexts other than `context`.
+  // - `self` is a unique_ptr for the object that this is being called on.
+  // - The return value is treated like a `Maybe`, i.e. if `nullptr` is
+  //   returned, any further deserialization of the message is stopped and
+  //   control is returned to the event loop or JS as soon as possible.
+  virtual BaseObjectPtr<BaseObject> Deserialize(
+      Environment* env,
+      v8::Local<v8::Context> context,
+      std::unique_ptr<TransferData> self) = 0;
+  // FinalizeTransferWrite() is the counterpart to
+  // BaseObject::FinalizeTransferRead(). It is called right after the transfer
+  // data was created, and defaults to doing nothing. After this function,
+  // this object should not hold any more Isolate-specific data.
+  virtual v8::Maybe<bool> FinalizeTransferWrite(
+      v8::Local<v8::Context> context, v8::ValueSerializer* serializer);
+};
+
 // Represents a single communication message.
 class Message : public MemoryRetainer {
  public:
@@ -54,16 +77,17 @@ class Message : public MemoryRetainer {
   void AddSharedArrayBuffer(std::shared_ptr<v8::BackingStore> backing_store);
   // Internal method of Message that is called once serialization finishes
   // and that transfers ownership of `data` to this message.
-  void AddMessagePort(std::unique_ptr<MessagePortData>&& data);
+  void AddTransferable(std::unique_ptr<TransferData>&& data);
   // Internal method of Message that is called when a new WebAssembly.Module
   // object is encountered in the incoming value's structure.
   uint32_t AddWASMModule(v8::CompiledWasmModule&& mod);
 
-  // The MessagePorts that will be transferred, as recorded by Serialize().
+  // The host objects that will be transferred, as recorded by Serialize()
+  // (e.g. MessagePorts).
   // Used for warning user about posting the target MessagePort to itself,
   // which will as a side effect destroy the communication channel.
-  const std::vector<std::unique_ptr<MessagePortData>>& message_ports() const {
-    return message_ports_;
+  const std::vector<std::unique_ptr<TransferData>>& transferables() const {
+    return transferables_;
   }
 
   void MemoryInfo(MemoryTracker* tracker) const override;
@@ -75,7 +99,7 @@ class Message : public MemoryRetainer {
   MallocedBuffer<char> main_message_buf_;
   std::vector<std::shared_ptr<v8::BackingStore>> array_buffers_;
   std::vector<std::shared_ptr<v8::BackingStore>> shared_array_buffers_;
-  std::vector<std::unique_ptr<MessagePortData>> message_ports_;
+  std::vector<std::unique_ptr<TransferData>> transferables_;
   std::vector<v8::CompiledWasmModule> wasm_modules_;
 
   friend class MessagePort;
@@ -83,7 +107,7 @@ class Message : public MemoryRetainer {
 
 // This contains all data for a `MessagePort` instance that is not tied to
 // a specific Environment/Isolate/event loop, for easier transfer between those.
-class MessagePortData : public MemoryRetainer {
+class MessagePortData : public TransferData {
  public:
   explicit MessagePortData(MessagePort* owner);
   ~MessagePortData() override;
@@ -108,6 +132,10 @@ class MessagePortData : public MemoryRetainer {
   void Disentangle();
 
   void MemoryInfo(MemoryTracker* tracker) const override;
+  BaseObjectPtr<BaseObject> Deserialize(
+      Environment* env,
+      v8::Local<v8::Context> context,
+      std::unique_ptr<TransferData> self) override;
 
   SET_MEMORY_INFO_NAME(MessagePortData)
   SET_SELF_SIZE(MessagePortData)
@@ -195,6 +223,9 @@ class MessagePort : public HandleWrap {
   // NULL pointer to the C++ MessagePort object is also detached.
   inline bool IsDetached() const;
 
+  TransferMode GetTransferMode() const override;
+  std::unique_ptr<TransferData> TransferForMessaging() override;
+
   void MemoryInfo(MemoryTracker* tracker) const override;
   SET_MEMORY_INFO_NAME(MessagePort)
   SET_SELF_SIZE(MessagePort)
@@ -214,6 +245,52 @@ class MessagePort : public HandleWrap {
   friend class MessagePortData;
 };
 
+// Provide a base class from which JS classes that should be transferable or
+// cloneable by postMesssage() can inherit.
+// See e.g. FileHandle in internal/fs/promises.js for an example.
+class JSTransferable : public BaseObject {
+ public:
+  JSTransferable(Environment* env, v8::Local<v8::Object> obj);
+  static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+
+  TransferMode GetTransferMode() const override;
+  std::unique_ptr<TransferData> TransferForMessaging() override;
+  std::unique_ptr<TransferData> CloneForMessaging() const override;
+  v8::Maybe<std::vector<BaseObjectPtr<BaseObject>>>
+      NestedTransferables() const override;
+  v8::Maybe<bool> FinalizeTransferRead(
+      v8::Local<v8::Context> context,
+      v8::ValueDeserializer* deserializer) override;
+
+  SET_NO_MEMORY_INFO()
+  SET_MEMORY_INFO_NAME(JSTransferable)
+  SET_SELF_SIZE(JSTransferable)
+
+ private:
+  std::unique_ptr<TransferData> TransferOrClone(TransferMode mode) const;
+
+  class Data : public TransferData {
+   public:
+    Data(std::string&& deserialize_info, v8::Global<v8::Value>&& data);
+
+    BaseObjectPtr<BaseObject> Deserialize(
+        Environment* env,
+        v8::Local<v8::Context> context,
+        std::unique_ptr<TransferData> self) override;
+    v8::Maybe<bool> FinalizeTransferWrite(
+        v8::Local<v8::Context> context,
+        v8::ValueSerializer* serializer) override;
+
+    SET_NO_MEMORY_INFO()
+    SET_MEMORY_INFO_NAME(JSTransferableTransferData)
+    SET_SELF_SIZE(Data)
+
+   private:
+    std::string deserialize_info_;
+    v8::Global<v8::Value> data_;
+  };
+};
+
 v8::Local<v8::FunctionTemplate> GetMessagePortConstructorTemplate(
     Environment* env);
 
diff --git a/src/node_perf.cc b/src/node_perf.cc
index 4ed1c956c9e52e..916a9974d5d6f9 100644
--- a/src/node_perf.cc
+++ b/src/node_perf.cc
@@ -644,6 +644,7 @@ void Initialize(Local<Object> target,
   eldh->SetClassName(eldh_classname);
   eldh->InstanceTemplate()->SetInternalFieldCount(
       ELDHistogram::kInternalFieldCount);
+  eldh->Inherit(BaseObject::GetConstructorTemplate(env));
   env->SetProtoMethod(eldh, "exceeds", ELDHistogramExceeds);
   env->SetProtoMethod(eldh, "min", ELDHistogramMin);
   env->SetProtoMethod(eldh, "max", ELDHistogramMax);
diff --git a/src/node_process_methods.cc b/src/node_process_methods.cc
index d580f74478cbf7..800ce0313647d4 100644
--- a/src/node_process_methods.cc
+++ b/src/node_process_methods.cc
@@ -426,7 +426,10 @@ static void ReallyExit(const FunctionCallbackInfo<Value>& args) {
 class FastHrtime : public BaseObject {
  public:
   static Local<Object> New(Environment* env) {
-    Local<v8::ObjectTemplate> otmpl = v8::ObjectTemplate::New(env->isolate());
+    Local<v8::FunctionTemplate> ctor =
+        v8::FunctionTemplate::New(env->isolate());
+    ctor->Inherit(BaseObject::GetConstructorTemplate(env));
+    Local<v8::ObjectTemplate> otmpl = ctor->InstanceTemplate();
     otmpl->SetInternalFieldCount(FastHrtime::kInternalFieldCount);
 
     auto create_func = [env](auto fast_func, auto slow_func) {
diff --git a/src/node_serdes.cc b/src/node_serdes.cc
index c7877215911f8e..28844f1858ff3d 100644
--- a/src/node_serdes.cc
+++ b/src/node_serdes.cc
@@ -451,6 +451,7 @@ void Initialize(Local<Object> target,
 
   ser->InstanceTemplate()->SetInternalFieldCount(
       SerializerContext::kInternalFieldCount);
+  ser->Inherit(BaseObject::GetConstructorTemplate(env));
 
   env->SetProtoMethod(ser, "writeHeader", SerializerContext::WriteHeader);
   env->SetProtoMethod(ser, "writeValue", SerializerContext::WriteValue);
@@ -478,6 +479,7 @@ void Initialize(Local<Object> target,
 
   des->InstanceTemplate()->SetInternalFieldCount(
       DeserializerContext::kInternalFieldCount);
+  des->Inherit(BaseObject::GetConstructorTemplate(env));
 
   env->SetProtoMethod(des, "readHeader", DeserializerContext::ReadHeader);
   env->SetProtoMethod(des, "readValue", DeserializerContext::ReadValue);
diff --git a/src/node_trace_events.cc b/src/node_trace_events.cc
index 9adee9e458ccc0..58813a9083a560 100644
--- a/src/node_trace_events.cc
+++ b/src/node_trace_events.cc
@@ -131,6 +131,7 @@ void NodeCategorySet::Initialize(Local<Object> target,
       env->NewFunctionTemplate(NodeCategorySet::New);
   category_set->InstanceTemplate()->SetInternalFieldCount(
       NodeCategorySet::kInternalFieldCount);
+  category_set->Inherit(BaseObject::GetConstructorTemplate(env));
   env->SetProtoMethod(category_set, "enable", NodeCategorySet::Enable);
   env->SetProtoMethod(category_set, "disable", NodeCategorySet::Disable);
 
diff --git a/src/node_util.cc b/src/node_util.cc
index ec3f8e1fe7deaf..199b04c95b44d4 100644
--- a/src/node_util.cc
+++ b/src/node_util.cc
@@ -325,6 +325,7 @@ void Initialize(Local<Object> target,
   weak_ref->InstanceTemplate()->SetInternalFieldCount(
       WeakReference::kInternalFieldCount);
   weak_ref->SetClassName(weak_ref_string);
+  weak_ref->Inherit(BaseObject::GetConstructorTemplate(env));
   env->SetProtoMethod(weak_ref, "get", WeakReference::Get);
   env->SetProtoMethod(weak_ref, "incRef", WeakReference::IncRef);
   env->SetProtoMethod(weak_ref, "decRef", WeakReference::DecRef);
diff --git a/src/node_wasi.cc b/src/node_wasi.cc
index 4a78f99365bbe6..48ef82bd088d6a 100644
--- a/src/node_wasi.cc
+++ b/src/node_wasi.cc
@@ -1679,6 +1679,7 @@ static void Initialize(Local<Object> target,
   auto wasi_wrap_string = FIXED_ONE_BYTE_STRING(env->isolate(), "WASI");
   tmpl->InstanceTemplate()->SetInternalFieldCount(WASI::kInternalFieldCount);
   tmpl->SetClassName(wasi_wrap_string);
+  tmpl->Inherit(BaseObject::GetConstructorTemplate(env));
 
   env->SetProtoMethod(tmpl, "args_get", WASI::ArgsGet);
   env->SetProtoMethod(tmpl, "args_sizes_get", WASI::ArgsSizesGet);
diff --git a/src/util.h b/src/util.h
index 62229e3c448637..8bdeb35184e99d 100644
--- a/src/util.h
+++ b/src/util.h
@@ -784,6 +784,12 @@ class FastStringKey {
   size_t cached_hash_;
 };
 
+// Like std::static_pointer_cast but for unique_ptr with the default deleter.
+template <typename T, typename U>
+std::unique_ptr<T> static_unique_pointer_cast(std::unique_ptr<U>&& ptr) {
+  return std::unique_ptr<T>(static_cast<T*>(ptr.release()));
+}
+
 }  // namespace node
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/test/parallel/test-bootstrap-modules.js b/test/parallel/test-bootstrap-modules.js
index b2506499e7d1c7..d4aa7bdd3142c5 100644
--- a/test/parallel/test-bootstrap-modules.js
+++ b/test/parallel/test-bootstrap-modules.js
@@ -17,6 +17,7 @@ const expectedModules = new Set([
   'Internal Binding credentials',
   'Internal Binding fs',
   'Internal Binding fs_dir',
+  'Internal Binding messaging',
   'Internal Binding module_wrap',
   'Internal Binding native_module',
   'Internal Binding options',
@@ -85,6 +86,7 @@ const expectedModules = new Set([
   'NativeModule internal/util/types',
   'NativeModule internal/validators',
   'NativeModule internal/vm/module',
+  'NativeModule internal/worker/js_transferable',
   'NativeModule path',
   'NativeModule perf_hooks',
   'NativeModule timers',
diff --git a/test/parallel/test-worker-message-port-transfer-fake-js-transferable-internal.js b/test/parallel/test-worker-message-port-transfer-fake-js-transferable-internal.js
new file mode 100644
index 00000000000000..87e34f054b24f7
--- /dev/null
+++ b/test/parallel/test-worker-message-port-transfer-fake-js-transferable-internal.js
@@ -0,0 +1,33 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs').promises;
+const { MessageChannel } = require('worker_threads');
+const { once } = require('events');
+
+// Test that overriding the internal kTransfer method of a JSTransferable does
+// not enable loading arbitrary code from internal Node.js core modules.
+
+(async function() {
+  const fh = await fs.open(__filename);
+  assert.strictEqual(fh.constructor.name, 'FileHandle');
+
+  const kTransfer = Object.getOwnPropertySymbols(Object.getPrototypeOf(fh))
+    .filter((symbol) => symbol.description === 'messaging_transfer_symbol')[0];
+  assert.strictEqual(typeof kTransfer, 'symbol');
+  fh[kTransfer] = () => {
+    return {
+      data: '✨',
+      deserializeInfo: 'net:Socket'
+    };
+  };
+
+  const { port1, port2 } = new MessageChannel();
+  port1.postMessage(fh, [ fh ]);
+  port2.on('message', common.mustNotCall());
+
+  const [ exception ] = await once(port2, 'messageerror');
+
+  assert.strictEqual(exception.message, 'Unknown deserialize spec net:Socket');
+  port2.close();
+})().then(common.mustCall());
diff --git a/test/parallel/test-worker-message-port-transfer-fake-js-transferable.js b/test/parallel/test-worker-message-port-transfer-fake-js-transferable.js
new file mode 100644
index 00000000000000..494adbb9e2bc7c
--- /dev/null
+++ b/test/parallel/test-worker-message-port-transfer-fake-js-transferable.js
@@ -0,0 +1,37 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs').promises;
+const { MessageChannel } = require('worker_threads');
+const { once } = require('events');
+
+// Test that overriding the internal kTransfer method of a JSTransferable does
+// not enable loading arbitrary code from the disk.
+
+module.exports = {
+  NotARealClass: common.mustNotCall()
+};
+
+(async function() {
+  const fh = await fs.open(__filename);
+  assert.strictEqual(fh.constructor.name, 'FileHandle');
+
+  const kTransfer = Object.getOwnPropertySymbols(Object.getPrototypeOf(fh))
+    .filter((symbol) => symbol.description === 'messaging_transfer_symbol')[0];
+  assert.strictEqual(typeof kTransfer, 'symbol');
+  fh[kTransfer] = () => {
+    return {
+      data: '✨',
+      deserializeInfo: `${__filename}:NotARealClass`
+    };
+  };
+
+  const { port1, port2 } = new MessageChannel();
+  port1.postMessage(fh, [ fh ]);
+  port2.on('message', common.mustNotCall());
+
+  const [ exception ] = await once(port2, 'messageerror');
+
+  assert.match(exception.message, /Missing internal module/);
+  port2.close();
+})().then(common.mustCall());
diff --git a/test/parallel/test-worker-message-port-transfer-filehandle.js b/test/parallel/test-worker-message-port-transfer-filehandle.js
new file mode 100644
index 00000000000000..157acb22e8ad55
--- /dev/null
+++ b/test/parallel/test-worker-message-port-transfer-filehandle.js
@@ -0,0 +1,71 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs').promises;
+const vm = require('vm');
+const { MessageChannel, moveMessagePortToContext } = require('worker_threads');
+const { once } = require('events');
+
+(async function() {
+  const fh = await fs.open(__filename);
+
+  const { port1, port2 } = new MessageChannel();
+
+  assert.throws(() => {
+    port1.postMessage(fh);
+  }, {
+    // See the TODO about error code in node_messaging.cc.
+    code: 'ERR_MISSING_MESSAGE_PORT_IN_TRANSFER_LIST'
+  });
+
+  // Check that transferring FileHandle instances works.
+  assert.notStrictEqual(fh.fd, -1);
+  port1.postMessage(fh, [ fh ]);
+  assert.strictEqual(fh.fd, -1);
+
+  const [ fh2 ] = await once(port2, 'message');
+  assert.strictEqual(Object.getPrototypeOf(fh2), Object.getPrototypeOf(fh));
+
+  assert.deepStrictEqual(await fh2.readFile(), await fs.readFile(__filename));
+  await fh2.close();
+
+  assert.rejects(() => fh.readFile(), { code: 'EBADF' });
+})().then(common.mustCall());
+
+(async function() {
+  // Check that there is no crash if the message is never read.
+  const fh = await fs.open(__filename);
+
+  const { port1 } = new MessageChannel();
+
+  assert.notStrictEqual(fh.fd, -1);
+  port1.postMessage(fh, [ fh ]);
+  assert.strictEqual(fh.fd, -1);
+})().then(common.mustCall());
+
+(async function() {
+  // Check that in the case of a context mismatch the message is discarded.
+  const fh = await fs.open(__filename);
+
+  const { port1, port2 } = new MessageChannel();
+
+  const ctx = vm.createContext();
+  const port2moved = moveMessagePortToContext(port2, ctx);
+  port2moved.onmessage = common.mustCall((msgEvent) => {
+    assert.strictEqual(msgEvent.data, 'second message');
+    port1.close();
+  });
+  // TODO(addaleax): Switch this to a 'messageerror' event once MessagePort
+  // implements EventTarget fully and in a cross-context manner.
+  port2moved.emit = common.mustCall((name, err) => {
+    assert.strictEqual(name, 'messageerror');
+    assert.strictEqual(err.code, 'ERR_MESSAGE_TARGET_CONTEXT_UNAVAILABLE');
+  });
+  port2moved.start();
+
+  assert.notStrictEqual(fh.fd, -1);
+  port1.postMessage(fh, [ fh ]);
+  assert.strictEqual(fh.fd, -1);
+
+  port1.postMessage('second message');
+})().then(common.mustCall());
diff --git a/test/parallel/test-worker-workerdata-messageport.js b/test/parallel/test-worker-workerdata-messageport.js
index 352d0729412ddb..9bf3422337e963 100644
--- a/test/parallel/test-worker-workerdata-messageport.js
+++ b/test/parallel/test-worker-workerdata-messageport.js
@@ -55,6 +55,7 @@ const meowScript = () => 'meow';
     transferList: []
   }), {
     code: 'ERR_MISSING_MESSAGE_PORT_IN_TRANSFER_LIST',
-    message: 'MessagePort was found in message but not listed in transferList'
+    message: 'Object that needs transfer was found in message but not ' +
+             'listed in transferList'
   });
 }