SIGN IN SIGN UP
oven-sh / bun UNCLAIMED

Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one

0 0 150 Rust

node:http2: reassemble HEADERS+CONTINUATION before HPACK decoding (#31323)

The node:http2 frame parser decoded each HEADERS and CONTINUATION
fragment independently and silently truncated the header list when an
HPACK instruction straddled a fragment boundary, which also left the
connection-scoped dynamic table out of sync. Fragments are now buffered
per stream and decoded once when END_HEADERS arrives; a decode failure
on a complete block tears down the connection with COMPRESSION_ERROR,
any non-CONTINUATION frame interleaved into an unfinished header block
is a PROTOCOL_ERROR, and the buffered compressed block is capped at
maxHeaderListSize. The header list size/count limits now finish
consuming the block before rejecting it so the dynamic table stays
consistent.

`request()` now also spreads its options object before the header block
is encoded (matching Node), so a user-supplied option getter that
re-entrantly calls `request()` can no longer reorder header blocks on
the wire relative to the order they were encoded.

Adds four raw-frame tests to test/js/node/http2/node-http2.test.js
covering reassembly of a block split mid-instruction, decode failure of
a complete block, an interleaved frame during reassembly, and an
oversized compressed block. The existing CONTINUATION suite
(150/300-header send and receive, large trailers, padding sweep) passes
unchanged.

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
J
Jarred Sumner committed
3fa963526542a6425dcb7c8d09897d65d84a6e9a
Parent: 9d5356a
Committed by GitHub <noreply@github.com> on 5/24/2026, 8:52:32 PM