gitroo-admin/node
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
node/lib/internal/http2
History
Exact
Matteo Collina 65a3ab3264
 http2: cap originSet size to prevent unbounded memory growth 
A malicious HTTP/2 server can send repeated ORIGIN frames with unique
origins, causing unbounded growth of the client-side originSet for the
lifetime of the session. Cap the set at 128 entries; once full, new
origins from ORIGIN frames are silently dropped.

Refs: https://hackerone.com/reports/3676863
PR-URL: https://github.com/nodejs-private/node-private/pull/855
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48619
2026-06-18 06:29:23 +02:00
..
compat.js http2: error for incomplete reads on RST, auto-drain, deprecate aborted 2026-06-01 10:59:19 +00:00
core.js http2: cap originSet size to prevent unbounded memory growth 2026-06-18 06:29:23 +02:00
util.js http2: add strictSingleValueFields option to relax header validation 2026-02-21 22:58:52 +00:00