Skip to content

http: reject responses exceeding header limit - #66281

Closed
mcollina wants to merge 0 commit into
nodejs:mainfrom
mcollina:fix-http-response-header-count-overflow
Closed

mcollina wants to merge 0 commit into
nodejs:mainfrom
mcollina:fix-http-response-header-count-overflow

Conversation

@mcollina

Copy link
Copy Markdown
Member

HTTP client parsers continued parsing headers after maxHeadersCount while omitting excess fields from IncomingMessage. Reject the response instead so framing headers cannot be hidden from the application.


AI generated, reviewed by me

@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/http
  • @nodejs/net

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. http_parser Issues and PRs related to the HTTP parser implementation or http_parser binding. needs-ci PRs that need a full CI run. labels Sep 25, 2026
@mcollina mcollina closed this Sep 25, 2026
@mcollina
mcollina force-pushed the fix-http-response-header-count-overflow branch from bbdea56 to 2b3e3db Compare September 25, 2026 13:05
@mcollina
mcollina deleted the fix-http-response-header-count-overflow branch September 25, 2026 13:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

c++ Issues and PRs that require attention from people who are familiar with C++. http_parser Issues and PRs related to the HTTP parser implementation or http_parser binding. needs-ci PRs that need a full CI run.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants