Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: nodejs/undici
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v6.23.0
Choose a base ref
...
head repository: nodejs/undici
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v6.24.0
Choose a head ref
  • 12 commits
  • 32 files changed
  • 4 contributors

Commits on Mar 12, 2026

  1. fix(websocket): add maxDecompressedMessageSize limit for permessage-d… 

    …eflate

Add protection against decompression bomb attacks in WebSocket
permessage-deflate extension. A malicious server could send a small
compressed payload that expands to an extremely large size, causing
memory exhaustion.

Changes:
- Add maxDecompressedMessageSize option to WebSocket constructor
- Default limit: 4 MB
- Abort decompression immediately when limit exceeded
- Close connection with status code 1009 (Message Too Big)
- Add MessageSizeExceededError (UND_ERR_WS_MESSAGE_SIZE_EXCEEDED)
- Add comprehensive tests for the new limit behavior
- Update TypeScript types and documentation

Signed-off-by: Matteo Collina <[email protected]>
(cherry picked from commit 2ee00cb)
    @mcollina
    mcollina committed Mar 12, 2026
    Configuration menu
    Copy the full SHA
    4b4f93a View commit details
    Browse the repository at this point in the history

  2. fix: validate server_max_window_bits range in permessage-deflate 

    The isValidClientWindowBits() function only checked for ASCII digits,
allowing out-of-range values like "1000" to pass validation. When these
values were passed to zlib's createInflateRaw(), it threw an unhandled
RangeError that crashed the process.

Changes:
- Update isValidClientWindowBits() to validate range 8-15 (per RFC 7692)
- Add try-catch around createInflateRaw() as defense in depth
- Add comprehensive tests for windowBits validation

(cherry picked from commit cb79c57)
    @mcollina
    mcollina committed Mar 12, 2026
    Configuration menu
    Copy the full SHA
    e9e2997 View commit details
    Browse the repository at this point in the history

  3. fix: validate upgrade header to prevent CRLF injection 

    Add validation for the upgrade option in Request constructor using
isValidHeaderValue() to prevent CRLF injection attacks that could
enable protocol smuggling to internal services.

Signed-off-by: Matteo Collina <[email protected]>
Co-Authored-By: Ulises Gascón <[email protected]>
Signed-off-by: Ulises Gascón <[email protected]>
(cherry picked from commit 77594f9)
    @mcollina @UlisesGascon
    mcollina and UlisesGascon committed Mar 12, 2026
    Configuration menu
    Copy the full SHA
    e43e898 View commit details
    Browse the repository at this point in the history

  4. Fix websocket 64-bit length overflow 

    Signed-off-by: Matteo Collina <[email protected]>
(cherry picked from commit 84235c6)
    @mcollina
    mcollina committed Mar 12, 2026
    Configuration menu
    Copy the full SHA
    5a97f08 View commit details
    Browse the repository at this point in the history

  5. fix: reject duplicate content-length and host headers 

    When headers are passed as an array, reject duplicate content-length
and host headers regardless of casing. This prevents malformed HTTP/1.1
requests with multiple Content-Length values from being sent on the wire.

Previously, case-variant duplicates (e.g., 'Content-Length' and
'content-length') would bypass the duplicate check, resulting in
ambiguous HTTP requests that could be interpreted inconsistently
by proxies and backends.

Signed-off-by: Matteo Collina <[email protected]>
(cherry picked from commit 74495c6)
    @mcollina
    mcollina committed Mar 12, 2026
    Configuration menu
    Copy the full SHA
    4e0179a View commit details
    Browse the repository at this point in the history

  6. fix: adapt websocket frame-limit handling for v6 parser 

    Signed-off-by: Matteo Collina <[email protected]>
    @mcollina
    mcollina committed Mar 12, 2026
    Configuration menu
    Copy the full SHA
    7df6442 View commit details
    Browse the repository at this point in the history

  7. test: increase bitness in test/fixtures/*.pem (#3659) 

    (cherry picked from commit e04abdd)
    @LiviaMedeiros @mcollina
    LiviaMedeiros authored and mcollina committed Mar 12, 2026
    Configuration menu
    Copy the full SHA
    4cd3f4b View commit details
    Browse the repository at this point in the history

  8. fix: h2 CI (#4395) 

    * test: fix key-size pem errors

* chore: use @metcoder95/https-pem

* fix: ci

* fix: ci

(cherry picked from commit 8dd120e)
    @metcoder95 @mcollina
    metcoder95 authored and mcollina committed Mar 12, 2026
    Configuration menu
    Copy the full SHA
    dc032a1 View commit details
    Browse the repository at this point in the history

  9. test: stabilize h2 and tls-cert-leak under current test runner 

    Signed-off-by: Matteo Collina <[email protected]>
    @mcollina
    mcollina committed Mar 12, 2026
    Configuration menu
    Copy the full SHA
    a444e4f View commit details
    Browse the repository at this point in the history

  10. test: fix http2 lint regressions in backport 

    Signed-off-by: Matteo Collina <[email protected]>
    @mcollina
    mcollina committed Mar 12, 2026
    Configuration menu
    Copy the full SHA
    844bf59 View commit details
    Browse the repository at this point in the history

  11. test(websocket): use node:assert for Node 18 compatibility 

    Signed-off-by: Matteo Collina <[email protected]>
    @mcollina
    mcollina committed Mar 12, 2026
    Configuration menu
    Copy the full SHA
    411bd01 View commit details
    Browse the repository at this point in the history

  12. Bumped v6.24.0 

    Signed-off-by: Matteo Collina <[email protected]>
    @mcollina
    mcollina committed Mar 12, 2026
    Configuration menu
    Copy the full SHA
    8873c94 View commit details
    Browse the repository at this point in the history
Loading