Repository navigation
http: reject responses exceeding header limit - #65010
Merged
nodejs-github-bot merged 1 commit intoSep 14, 2026
Merged
nodejs-github-bot merged 1 commit into
nodejs-github-bot merged 1 commit into
Conversation
Previously, ClientRequest silently truncated responses that exceeded request.maxHeadersCount while llhttp continued using omitted headers. Reject these responses with HPE_HEADER_OVERFLOW so parser state and exposed headers cannot diverge. This is a semver-major behavior change. Signed-off-by: Matteo Collina <hello@matteocollina.com>
Collaborator
|
Review requested:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #65010 +/- ##
==========================================
- Coverage 90.27% 90.27% -0.01%
==========================================
Files 762 762
Lines 247515 247644 +129
Branches 46683 46697 +14
==========================================
+ Hits 223447 223552 +105
- Misses 15485 15528 +43
+ Partials 8583 8564 -19
🚀 New features to boost your workflow:
|
aduh95
reviewed
Aug 4, 2026
| if (parser_.type != HTTP_REQUEST) { | ||
| return 0; | ||
| } | ||
|
|
Contributor
There was a problem hiding this comment.
@lpinca FYI since you mentioned those lines in the 26.6.0 proposal
ronag
approved these changes
Aug 7, 2026
ShogunPanda
approved these changes
Aug 19, 2026
jasnell
approved these changes
Aug 20, 2026
bjohansebas
approved these changes
Aug 20, 2026
This comment was marked as outdated.
This comment was marked as outdated.
Collaborator
bjohansebas
approved these changes
Aug 23, 2026
avivkeller
reviewed
Aug 24, 2026
| @@ -1127,9 +1127,11 @@ const hasContentType = request.hasHeader('content-type'); | |||
|
|
|||
| ### `request.maxHeadersCount` | |||
|
|
|||
Member
There was a problem hiding this comment.
Should you add a changes entry?
avivkeller
approved these changes
Aug 24, 2026
Collaborator
|
Landed in e5778f7 |
RafaelGSS
added a commit
that referenced
this pull request
Oct 27, 2026
Notable changes: async_hooks: * (SEMVER-MAJOR) remove legacy AsyncLocalStorage implementation (Matteo Collina) #63641 benchmark: * (SEMVER-MAJOR) protect against accidental fork bomb (James M Snell) #66132 build: * (SEMVER-MAJOR) remove the bundled FIPS provider build (Filip Skokan) #64777 * (SEMVER-MAJOR) require OpenSSL 3 or later (Filip Skokan) #64777 * (SEMVER-MAJOR) downgrade Intel macOS support to experimental (Antoine du Hamel) #65427 crypto: * (SEMVER-MAJOR) move DEP0093 to End-of-Life (Filip Skokan) #64777 * (SEMVER-MAJOR) remove legacy OpenSSL code paths (Filip Skokan) #64777 * (SEMVER-MAJOR) validate digest output encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate update input encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247 * (SEMVER-MAJOR) move DEP0198 to End-of-Life (Filip Skokan) #64000 * (SEMVER-MAJOR) move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188 * (SEMVER-MAJOR) reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925 * (SEMVER-MAJOR) throw on uninitialized DH computeSecret (Filip Skokan) #63922 * (SEMVER-MAJOR) runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624 crypto,https,tls: * (SEMVER-MAJOR) end OpenSSL engine support (Filip Skokan) #64777 deps: * (SEMVER-MAJOR) update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777 * (SEMVER-MAJOR) update V8 to 15.6.75.13 (Joyee Cheung) #66601 * (SEMVER-MAJOR) update V8 to 15.5.35.20 (Joyee Cheung) #66537 * (SEMVER-MAJOR) update V8 to 15.2.124.38 (Joyee Cheung) #65161 * (SEMVER-MAJOR) upgrade npm to 12.1.0 (npm team) #66212 dgram: * (SEMVER-MAJOR) skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131 dns: * (SEMVER-MAJOR) do not consult hosts file in reverse lookups (Archkon) #64268 * (SEMVER-MAJOR) stop using deprecated functions in `SetServers` (Antoine du Hamel) #64356 doc: * (SEMVER-MAJOR) remove OpenSSL 1.x references (Filip Skokan) #64777 * (SEMVER-MAJOR) update Node.js 27 official binary toolchains (Richard Lau) #66377 domain: * (SEMVER-MAJOR) runtime-deprecate the module (Matteo Collina) #65074 * (SEMVER-MAJOR) port to AsyncLocalStorage (Matteo Collina) #61095 fs: * (SEMVER-MAJOR) implement glob natively (Aviv Keller) #65392 * (SEMVER-MAJOR) return Buffer from mkdtemp when prefix is a Buffer (Hamid Reza Ghavami) #64397 http: * (SEMVER-MAJOR) reject responses exceeding header limit (Matteo Collina) #65010 * (SEMVER-MAJOR) runtime deprecate instantiating without new (Yagiz Nizipli) #64853 * (SEMVER-MAJOR) increase keepAliveTimeout default to 65 seconds (Tim Perry) #62782 * (SEMVER-MAJOR) make req.headers have a null prototype (Matteo Collina) #62900 * (SEMVER-MAJOR) reject addTrailers after finish (Ryuhei Shima) #62832 http2: * (SEMVER-MAJOR) increase default window sizes (Matteo Collina) #64623 lib: * (SEMVER-MAJOR) deprecate _http_* (Sebastian Beltran) #58535 * (SEMVER-MAJOR) insert argv[0] at argv[1] in setDeserializeMainFunction (Daijiro Wachi) #62928 * (SEMVER-MAJOR) use `Object.freeze` to avoid defensive cloning in `SourceMap` (Daijiro Wachi) #62830 * (SEMVER-MAJOR) reject SharedArrayBuffer in Blob constructor per spec (Ali Hassan) #63046 lib,src: * (SEMVER-MAJOR) remove `--no-experimental-websocket` CLI flag (Antoine du Hamel) #65284 net: * (SEMVER-MAJOR) race family autoselection attempts (Matteo Collina) #66229 * (SEMVER-MAJOR) throw on multiple listen calls (Matteo Collina) #64871 * (SEMVER-MAJOR) runtime-deprecate Server.prototype._listen2 (Guilherme Araújo) #64794 * (SEMVER-MAJOR) add experimental net/promises API (Ethan Arrowood) #63965 repl: * (SEMVER-MAJOR) use inspector over vm (Aviv Keller) #64034 src: * (SEMVER-MAJOR) officially deprecate `node::ObjectWrap` (Anna Henningsen) #63756 * (SEMVER-MAJOR) merge `CreateEnvironment()` overloads (Anna Henningsen) #63596 src, test: src,lib: * (SEMVER-MAJOR) add --allow-env permission (James M Snell) #66132 stream: * (SEMVER-MAJOR) destroy source when map iterator closes early (Y1D7NG) #64264 test: * (SEMVER-MAJOR) fix fs write encoding coverage (Filip Skokan) #66247 test,benchmark: * (SEMVER-MAJOR) drop OpenSSL 1.x-only coverage (Filip Skokan) #64777 test,tools: * (SEMVER-MAJOR) drop OpenSSL 1.x-era FIPS leftovers (Filip Skokan) #64777 test_runner: * use AsyncLocalStorage instead of async_hooks (Matteo Collina) #66795 tls: * (SEMVER-MAJOR) move _tls_* to end-of-life (Sebastian Beltran) #60658 zlib: * (SEMVER-MAJOR) convert classes to modern syntax and eol DEP0184 (Yagiz Nizipli) #64849 PR-URL: #67062
RafaelGSS
added a commit
that referenced
this pull request
Oct 27, 2026
Notable changes: async_hooks: * (SEMVER-MAJOR) remove legacy AsyncLocalStorage implementation (Matteo Collina) #63641 benchmark: * (SEMVER-MAJOR) protect against accidental fork bomb (James M Snell) #66132 build: * (SEMVER-MAJOR) remove the bundled FIPS provider build (Filip Skokan) #64777 * (SEMVER-MAJOR) require OpenSSL 3 or later (Filip Skokan) #64777 * (SEMVER-MAJOR) downgrade Intel macOS support to experimental (Antoine du Hamel) #65427 crypto: * (SEMVER-MAJOR) move DEP0093 to End-of-Life (Filip Skokan) #64777 * (SEMVER-MAJOR) remove legacy OpenSSL code paths (Filip Skokan) #64777 * (SEMVER-MAJOR) validate digest output encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate update input encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247 * (SEMVER-MAJOR) move DEP0198 to End-of-Life (Filip Skokan) #64000 * (SEMVER-MAJOR) move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188 * (SEMVER-MAJOR) reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925 * (SEMVER-MAJOR) throw on uninitialized DH computeSecret (Filip Skokan) #63922 * (SEMVER-MAJOR) runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624 crypto,https,tls: * (SEMVER-MAJOR) end OpenSSL engine support (Filip Skokan) #64777 deps: * (SEMVER-MAJOR) update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777 * (SEMVER-MAJOR) update V8 to 15.6.75.13 (Joyee Cheung) #66601 * (SEMVER-MAJOR) update V8 to 15.5.35.20 (Joyee Cheung) #66537 * (SEMVER-MAJOR) update V8 to 15.2.124.38 (Joyee Cheung) #65161 * (SEMVER-MAJOR) upgrade npm to 12.1.0 (npm team) #66212 dgram: * (SEMVER-MAJOR) skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131 dns: * (SEMVER-MAJOR) do not consult hosts file in reverse lookups (Archkon) #64268 * (SEMVER-MAJOR) stop using deprecated functions in `SetServers` (Antoine du Hamel) #64356 doc: * (SEMVER-MAJOR) remove OpenSSL 1.x references (Filip Skokan) #64777 * (SEMVER-MAJOR) update Node.js 27 official binary toolchains (Richard Lau) #66377 domain: * (SEMVER-MAJOR) runtime-deprecate the module (Matteo Collina) #65074 * (SEMVER-MAJOR) port to AsyncLocalStorage (Matteo Collina) #61095 fs: * (SEMVER-MAJOR) implement glob natively (Aviv Keller) #65392 * (SEMVER-MAJOR) return Buffer from mkdtemp when prefix is a Buffer (Hamid Reza Ghavami) #64397 http: * (SEMVER-MAJOR) reject responses exceeding header limit (Matteo Collina) #65010 * (SEMVER-MAJOR) runtime deprecate instantiating without new (Yagiz Nizipli) #64853 * (SEMVER-MAJOR) increase keepAliveTimeout default to 65 seconds (Tim Perry) #62782 * (SEMVER-MAJOR) make req.headers have a null prototype (Matteo Collina) #62900 * (SEMVER-MAJOR) reject addTrailers after finish (Ryuhei Shima) #62832 http2: * (SEMVER-MAJOR) increase default window sizes (Matteo Collina) #64623 lib: * (SEMVER-MAJOR) deprecate _http_* (Sebastian Beltran) #58535 * (SEMVER-MAJOR) insert argv[0] at argv[1] in setDeserializeMainFunction (Daijiro Wachi) #62928 * (SEMVER-MAJOR) use `Object.freeze` to avoid defensive cloning in `SourceMap` (Daijiro Wachi) #62830 * (SEMVER-MAJOR) reject SharedArrayBuffer in Blob constructor per spec (Ali Hassan) #63046 lib,src: * (SEMVER-MAJOR) remove `--no-experimental-websocket` CLI flag (Antoine du Hamel) #65284 net: * (SEMVER-MAJOR) race family autoselection attempts (Matteo Collina) #66229 * (SEMVER-MAJOR) throw on multiple listen calls (Matteo Collina) #64871 * (SEMVER-MAJOR) runtime-deprecate Server.prototype._listen2 (Guilherme Araújo) #64794 * (SEMVER-MAJOR) add experimental net/promises API (Ethan Arrowood) #63965 repl: * (SEMVER-MAJOR) use inspector over vm (Aviv Keller) #64034 src: * (SEMVER-MAJOR) officially deprecate `node::ObjectWrap` (Anna Henningsen) #63756 * (SEMVER-MAJOR) merge `CreateEnvironment()` overloads (Anna Henningsen) #63596 src, test: src,lib: * (SEMVER-MAJOR) add --allow-env permission (James M Snell) #66132 stream: * (SEMVER-MAJOR) destroy source when map iterator closes early (Y1D7NG) #64264 test: * (SEMVER-MAJOR) fix fs write encoding coverage (Filip Skokan) #66247 test,benchmark: * (SEMVER-MAJOR) drop OpenSSL 1.x-only coverage (Filip Skokan) #64777 test,tools: * (SEMVER-MAJOR) drop OpenSSL 1.x-era FIPS leftovers (Filip Skokan) #64777 test_runner: * use AsyncLocalStorage instead of async_hooks (Matteo Collina) #66795 tls: * (SEMVER-MAJOR) move _tls_* to end-of-life (Sebastian Beltran) #60658 zlib: * (SEMVER-MAJOR) convert classes to modern syntax and eol DEP0184 (Yagiz Nizipli) #64849 PR-URL: #67062
RafaelGSS
added a commit
that referenced
this pull request
Oct 27, 2026
Notable changes: async_hooks: * (SEMVER-MAJOR) remove legacy AsyncLocalStorage implementation (Matteo Collina) #63641 benchmark: * (SEMVER-MAJOR) protect against accidental fork bomb (James M Snell) #66132 build: * (SEMVER-MAJOR) remove the bundled FIPS provider build (Filip Skokan) #64777 * (SEMVER-MAJOR) require OpenSSL 3 or later (Filip Skokan) #64777 * (SEMVER-MAJOR) downgrade Intel macOS support to experimental (Antoine du Hamel) #65427 crypto: * (SEMVER-MAJOR) move DEP0093 to End-of-Life (Filip Skokan) #64777 * (SEMVER-MAJOR) remove legacy OpenSSL code paths (Filip Skokan) #64777 * (SEMVER-MAJOR) validate digest output encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate update input encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247 * (SEMVER-MAJOR) move DEP0198 to End-of-Life (Filip Skokan) #64000 * (SEMVER-MAJOR) move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188 * (SEMVER-MAJOR) reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925 * (SEMVER-MAJOR) throw on uninitialized DH computeSecret (Filip Skokan) #63922 * (SEMVER-MAJOR) runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624 crypto,https,tls: * (SEMVER-MAJOR) end OpenSSL engine support (Filip Skokan) #64777 deps: * (SEMVER-MAJOR) update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777 * (SEMVER-MAJOR) update V8 to 15.6.75.13 (Joyee Cheung) #66601 * (SEMVER-MAJOR) update V8 to 15.5.35.20 (Joyee Cheung) #66537 * (SEMVER-MAJOR) update V8 to 15.2.124.38 (Joyee Cheung) #65161 * (SEMVER-MAJOR) upgrade npm to 12.1.0 (npm team) #66212 dgram: * (SEMVER-MAJOR) skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131 dns: * (SEMVER-MAJOR) do not consult hosts file in reverse lookups (Archkon) #64268 * (SEMVER-MAJOR) stop using deprecated functions in `SetServers` (Antoine du Hamel) #64356 doc: * (SEMVER-MAJOR) remove OpenSSL 1.x references (Filip Skokan) #64777 * (SEMVER-MAJOR) update Node.js 27 official binary toolchains (Richard Lau) #66377 domain: * (SEMVER-MAJOR) runtime-deprecate the module (Matteo Collina) #65074 * (SEMVER-MAJOR) port to AsyncLocalStorage (Matteo Collina) #61095 fs: * (SEMVER-MAJOR) implement glob natively (Aviv Keller) #65392 * (SEMVER-MAJOR) return Buffer from mkdtemp when prefix is a Buffer (Hamid Reza Ghavami) #64397 http: * (SEMVER-MAJOR) reject responses exceeding header limit (Matteo Collina) #65010 * (SEMVER-MAJOR) runtime deprecate instantiating without new (Yagiz Nizipli) #64853 * (SEMVER-MAJOR) increase keepAliveTimeout default to 65 seconds (Tim Perry) #62782 * (SEMVER-MAJOR) make req.headers have a null prototype (Matteo Collina) #62900 * (SEMVER-MAJOR) reject addTrailers after finish (Ryuhei Shima) #62832 http2: * (SEMVER-MAJOR) increase default window sizes (Matteo Collina) #64623 lib: * (SEMVER-MAJOR) deprecate _http_* (Sebastian Beltran) #58535 * (SEMVER-MAJOR) insert argv[0] at argv[1] in setDeserializeMainFunction (Daijiro Wachi) #62928 * (SEMVER-MAJOR) use `Object.freeze` to avoid defensive cloning in `SourceMap` (Daijiro Wachi) #62830 * (SEMVER-MAJOR) reject SharedArrayBuffer in Blob constructor per spec (Ali Hassan) #63046 lib,src: * (SEMVER-MAJOR) remove `--no-experimental-websocket` CLI flag (Antoine du Hamel) #65284 net: * (SEMVER-MAJOR) race family autoselection attempts (Matteo Collina) #66229 * (SEMVER-MAJOR) throw on multiple listen calls (Matteo Collina) #64871 * (SEMVER-MAJOR) runtime-deprecate Server.prototype._listen2 (Guilherme Araújo) #64794 * (SEMVER-MAJOR) add experimental net/promises API (Ethan Arrowood) #63965 repl: * (SEMVER-MAJOR) use inspector over vm (Aviv Keller) #64034 src: * (SEMVER-MAJOR) officially deprecate `node::ObjectWrap` (Anna Henningsen) #63756 * (SEMVER-MAJOR) merge `CreateEnvironment()` overloads (Anna Henningsen) #63596 src, test: src,lib: * (SEMVER-MAJOR) add --allow-env permission (James M Snell) #66132 stream: * (SEMVER-MAJOR) destroy source when map iterator closes early (Y1D7NG) #64264 test: * (SEMVER-MAJOR) fix fs write encoding coverage (Filip Skokan) #66247 test,benchmark: * (SEMVER-MAJOR) drop OpenSSL 1.x-only coverage (Filip Skokan) #64777 test,tools: * (SEMVER-MAJOR) drop OpenSSL 1.x-era FIPS leftovers (Filip Skokan) #64777 test_runner: * use AsyncLocalStorage instead of async_hooks (Matteo Collina) #66795 tls: * (SEMVER-MAJOR) move _tls_* to end-of-life (Sebastian Beltran) #60658 zlib: * (SEMVER-MAJOR) convert classes to modern syntax and eol DEP0184 (Yagiz Nizipli) #64849 PR-URL: #67062
RafaelGSS
added a commit
that referenced
this pull request
Oct 27, 2026
Notable changes: async_hooks: * (SEMVER-MAJOR) remove legacy AsyncLocalStorage implementation (Matteo Collina) #63641 benchmark: * (SEMVER-MAJOR) protect against accidental fork bomb (James M Snell) #66132 build: * (SEMVER-MAJOR) remove the bundled FIPS provider build (Filip Skokan) #64777 * (SEMVER-MAJOR) require OpenSSL 3 or later (Filip Skokan) #64777 * (SEMVER-MAJOR) downgrade Intel macOS support to experimental (Antoine du Hamel) #65427 crypto: * (SEMVER-MAJOR) move DEP0093 to End-of-Life (Filip Skokan) #64777 * (SEMVER-MAJOR) remove legacy OpenSSL code paths (Filip Skokan) #64777 * (SEMVER-MAJOR) validate digest output encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate update input encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247 * (SEMVER-MAJOR) move DEP0198 to End-of-Life (Filip Skokan) #64000 * (SEMVER-MAJOR) move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188 * (SEMVER-MAJOR) reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925 * (SEMVER-MAJOR) throw on uninitialized DH computeSecret (Filip Skokan) #63922 * (SEMVER-MAJOR) runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624 crypto,https,tls: * (SEMVER-MAJOR) end OpenSSL engine support (Filip Skokan) #64777 deps: * (SEMVER-MAJOR) update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777 * (SEMVER-MAJOR) update V8 to 15.6.75.13 (Joyee Cheung) #66601 * (SEMVER-MAJOR) update V8 to 15.5.35.20 (Joyee Cheung) #66537 * (SEMVER-MAJOR) update V8 to 15.2.124.38 (Joyee Cheung) #65161 * (SEMVER-MAJOR) upgrade npm to 12.1.0 (npm team) #66212 dgram: * (SEMVER-MAJOR) skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131 dns: * (SEMVER-MAJOR) do not consult hosts file in reverse lookups (Archkon) #64268 * (SEMVER-MAJOR) stop using deprecated functions in `SetServers` (Antoine du Hamel) #64356 doc: * (SEMVER-MAJOR) remove OpenSSL 1.x references (Filip Skokan) #64777 * (SEMVER-MAJOR) update Node.js 27 official binary toolchains (Richard Lau) #66377 domain: * (SEMVER-MAJOR) runtime-deprecate the module (Matteo Collina) #65074 * (SEMVER-MAJOR) port to AsyncLocalStorage (Matteo Collina) #61095 fs: * (SEMVER-MAJOR) implement glob natively (Aviv Keller) #65392 * (SEMVER-MAJOR) return Buffer from mkdtemp when prefix is a Buffer (Hamid Reza Ghavami) #64397 http: * (SEMVER-MAJOR) reject responses exceeding header limit (Matteo Collina) #65010 * (SEMVER-MAJOR) runtime deprecate instantiating without new (Yagiz Nizipli) #64853 * (SEMVER-MAJOR) increase keepAliveTimeout default to 65 seconds (Tim Perry) #62782 * (SEMVER-MAJOR) make req.headers have a null prototype (Matteo Collina) #62900 * (SEMVER-MAJOR) reject addTrailers after finish (Ryuhei Shima) #62832 http2: * (SEMVER-MAJOR) increase default window sizes (Matteo Collina) #64623 lib: * (SEMVER-MAJOR) deprecate _http_* (Sebastian Beltran) #58535 * (SEMVER-MAJOR) insert argv[0] at argv[1] in setDeserializeMainFunction (Daijiro Wachi) #62928 * (SEMVER-MAJOR) use `Object.freeze` to avoid defensive cloning in `SourceMap` (Daijiro Wachi) #62830 * (SEMVER-MAJOR) reject SharedArrayBuffer in Blob constructor per spec (Ali Hassan) #63046 lib,src: * (SEMVER-MAJOR) remove `--no-experimental-websocket` CLI flag (Antoine du Hamel) #65284 net: * (SEMVER-MAJOR) race family autoselection attempts (Matteo Collina) #66229 * (SEMVER-MAJOR) throw on multiple listen calls (Matteo Collina) #64871 * (SEMVER-MAJOR) runtime-deprecate Server.prototype._listen2 (Guilherme Araújo) #64794 * (SEMVER-MAJOR) add experimental net/promises API (Ethan Arrowood) #63965 repl: * (SEMVER-MAJOR) use inspector over vm (Aviv Keller) #64034 src: * (SEMVER-MAJOR) officially deprecate `node::ObjectWrap` (Anna Henningsen) #63756 * (SEMVER-MAJOR) merge `CreateEnvironment()` overloads (Anna Henningsen) #63596 src, test: src,lib: * (SEMVER-MAJOR) add --allow-env permission (James M Snell) #66132 stream: * (SEMVER-MAJOR) destroy source when map iterator closes early (Y1D7NG) #64264 test: * (SEMVER-MAJOR) fix fs write encoding coverage (Filip Skokan) #66247 test,benchmark: * (SEMVER-MAJOR) drop OpenSSL 1.x-only coverage (Filip Skokan) #64777 test,tools: * (SEMVER-MAJOR) drop OpenSSL 1.x-era FIPS leftovers (Filip Skokan) #64777 test_runner: * use AsyncLocalStorage instead of async_hooks (Matteo Collina) #66795 tls: * (SEMVER-MAJOR) move _tls_* to end-of-life (Sebastian Beltran) #60658 zlib: * (SEMVER-MAJOR) convert classes to modern syntax and eol DEP0184 (Yagiz Nizipli) #64849 PR-URL: #67062
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previously, ClientRequest silently truncated responses that exceeded request.maxHeadersCount while llhttp continued using omitted headers.
Reject these responses with HPE_HEADER_OVERFLOW so parser state and exposed headers cannot diverge. This is a semver-major behavior change.