Matteo Collina
e5778f78c5
http: reject responses exceeding header limit
...
Previously, ClientRequest silently truncated responses that exceeded
request.maxHeadersCount while llhttp continued using omitted headers.
Reject these responses with HPE_HEADER_OVERFLOW so parser state and
exposed headers cannot diverge. This is a semver-major behavior change.
Signed-off-by: Matteo Collina <hello@matteocollina.com >
PR-URL: https://github.com/nodejs/node/pull/65010
Reviewed-By: Robert Nagy <ronagy@icloud.com >
Reviewed-By: Paolo Insogna <paolo@cowtech.it >
Reviewed-By: James M Snell <jasnell@gmail.com >
Reviewed-By: Aviv Keller <me@aviv.sh >
2026-09-14 08:39:17 +00:00
Matteo Collina
821688aaa0
http: reject requests exceeding max header count
...
PR-URL: https://github.com/nodejs-private/node-private/pull/922
Refs: https://hackerone.com/reports/3564941
CVE-ID: CVE-2026-58044
2026-07-29 10:42:07 -03:00
Antoine du Hamel
d539d6e99f
test: ensure assertions are reached on more tests
...
PR-URL: https://github.com/nodejs/node/pull/60759
Reviewed-By: Colin Ihrig <cjihrig@gmail.com >
2025-11-24 22:36:53 +00:00
ed3604cd64
http: server check Host header, to meet RFC 7230 5.4 requirement
...
PR-URL: https://github.com/nodejs/node/pull/45597
Fixes: https://github.com/nodejs/node/issues/39033
Co-authored-by: Luigi Pinca <luigipinca@gmail.com >
Co-authored-by: mscdex <mscdex@users.noreply.github.com >
Reviewed-By: Robert Nagy <ronagy@icloud.com >
Reviewed-By: Paolo Insogna <paolo@cowtech.it >
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com >
Reviewed-By: Matteo Collina <matteo.collina@gmail.com >
2022-11-28 18:35:31 +01:00
Paolo Insogna
4267b92604
http: use Keep-Alive by default in global agents
...
PR-URL: https://github.com/nodejs/node/pull/43522
Fixes: https://github.com/nodejs/node/issues/37184
Reviewed-By: Matteo Collina <matteo.collina@gmail.com >
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com >
2022-06-29 12:48:52 +02:00
Rich Trott
330f25ef82
test: prepare for consistent comma-dangle lint rule
...
Make changes so that tests will pass when the comma-dangle settings
applied to the rest of the code base are also applied to tests.
PR-URL: https://github.com/nodejs/node/pull/37930
Reviewed-By: James M Snell <jasnell@gmail.com >
Reviewed-By: Derek Lewis <DerekNonGeneric@inf.is >
2021-04-01 23:14:29 -07:00
Matteo Collina
186035243f
deps,http: http_parser set max header size to 8KB
...
CVE-2018-12121
PR-URL: https://github.com/nodejs-private/node-private/pull/143
Ref: https://github.com/nodejs-private/security/issues/139
Ref: https://github.com/nodejs-private/http-parser-private/pull/2
Reviewed-By: Anatoli Papirovski <apapirovski@mac.com >
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl >
Reviewed-By: James M Snell <jasnell@gmail.com >
Reviewed-By: Rod Vagg <rod@vagg.org >
Reviewed-By: Anna Henningsen <anna@addaleax.net >
2018-11-28 11:36:34 +11:00
Daiki Arai
67790962da
https: defines maxHeadersCount in the constructor
...
In Refs, http.Server's maxHeadersCount field was defined in the
constructor to make hidden class stable and so on. Also in https.Server,
we can use maxHeadersCount the same as http via connectionListener. So,
defines it in the constructor and documentation.
Refs: https://github.com/nodejs/node/pull/9116
PR-URL: https://github.com/nodejs/node/pull/20359
Reviewed-By: Matteo Collina <matteo.collina@gmail.com >
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com >
2018-05-05 13:57:07 +02:00
Matteo Collina