gitroo-admin/node
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
node/lib/internal/http2
History
Exact
Matteo Collina c79968e108
 http2: cap originSet size to prevent unbounded memory growth 
A malicious HTTP/2 server can send repeated ORIGIN frames with unique
origins, causing unbounded growth of the client-side originSet for the
lifetime of the session. Cap the set at 128 entries; once full, new
origins from ORIGIN frames are silently dropped.

Ref: https://hackerone.com/reports/3676863
PR-URL: https://github.com/nodejs-private/node-private/pull/855
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48619
Refs: https://hackerone.com/reports/3676863
2026-06-17 19:52:19 +02:00
..
compat.js http2: skip writeHead if stream is closed 2025-05-19 12:13:51 +02:00
core.js http2: cap originSet size to prevent unbounded memory growth 2026-06-17 19:52:19 +02:00
util.js http2: rename variable to additionalPseudoHeaders 2026-02-17 19:16:42 +01:00