Skip to content

https: limit proxy CONNECT response headers#64545

Open
mcollina wants to merge 1 commit into
nodejs:mainfrom
mcollina:fix/https-proxy-connect-header-limit
Open

https: limit proxy CONNECT response headers#64545
mcollina wants to merge 1 commit into
nodejs:mainfrom
mcollina:fix/https-proxy-connect-header-limit

Conversation

@mcollina

@mcollina mcollina commented Jul 16, 2026

Copy link
Copy Markdown
Member
  • enforce the effective HTTP maximum header size while reading HTTPS proxy CONNECT responses
  • use a one-shot readable listener while waiting for additional response data
  • add regression coverage for fragmented, incomplete proxy response headers

Apply the configured maximum header size while reading CONNECT
responses. Rearm the readable listener only once per read pass to avoid
unbounded buffer and listener growth.

Signed-off-by: Matteo Collina <hello@matteocollina.com>
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/crypto
  • @nodejs/http
  • @nodejs/net

@nodejs-github-bot nodejs-github-bot added https Issues or PRs related to the https subsystem. needs-ci PRs that need a full CI run. labels Jul 16, 2026
@mcollina
mcollina marked this pull request as ready for review July 16, 2026 19:37
@codecov

codecov Bot commented Jul 16, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.23%. Comparing base (cf882a7) to head (6c6d170).
⚠️ Report is 10 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #64545      +/-   ##
==========================================
- Coverage   90.24%   90.23%   -0.01%     
==========================================
  Files         739      739              
  Lines      241667   241712      +45     
  Branches    45550    45542       -8     
==========================================
+ Hits       218093   218120      +27     
+ Misses      15109    15107       -2     
- Partials     8465     8485      +20     
Files with missing lines Coverage Δ
lib/https.js 98.26% <100.00%> (+0.03%) ⬆️

... and 29 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@pimterry pimterry added the request-ci Add this label to start a Jenkins CI on a PR. label Jul 17, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 17, 2026
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

@mcollina
mcollina requested a review from joyeecheung July 17, 2026 13:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

https Issues or PRs related to the https subsystem. needs-ci PRs that need a full CI run.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants