Assisted-by: OpenAI:gpt-5.4

(cherry picked from commit aeed21a)

Signed-off-by: Kamat, Trivikram <[email protected]>
Co-authored-by: Trivikram Kamat <[email protected]>

Stop the permessage-deflate inflater after removing its listeners so a late zlib error cannot become an uncaught exception. Add regression coverage for malformed compressed payloads that exceed the configured limit.

Fixes: GHSA-3wwx-pv8p-q78v
CVE: CVE-2026-85024
Signed-off-by: Matteo Collina <[email protected]>
(cherry picked from commit fa45246280698732d8822571da3ae650a8cdfa10)
(cherry picked from commit 96f455485e0ccd224c839f2478b7dad0b53c1b1e)

Guard the opening-handshake protocol check when the client did not request any subprotocols. Fail the WebSocket connection with protocol error 1002 instead of allowing a TypeError to escape from the response microtask and terminate the process.

Fixes: GHSA-rfgv-xxqx-mfg5
CVE: CVE-2026-19534
Signed-off-by: Matteo Collina <[email protected]>
(cherry picked from commit 3e2c9c7210ce437636e58df4804fa7d689d5ca7a)

Checkpoint the original response framing before exposing headers and reject resumed responses whose Content-Range does not match it. Do not retry after an exposed response without a resumable length, preventing attacker-controlled retry responses from being concatenated into downstream output.

Fixes: GHSA-r53p-7pc4-xj5r
CVE: CVE-2026-18540
Signed-off-by: Matteo Collina <[email protected]>

…) (#5770)

(cherry picked from commit 8c9182e)
Signed-off-by: Matteo Collina <[email protected]>

# Conflicts:
#	test/node-test/keep-alive-reuse.js

Co-authored-by: Yagiz Nizipli <[email protected]>

Co-authored-by: github-actions <[email protected]>

Adapt the response-ownership guard from e905b5b to the v6 handler interface. Abort terminal attempts instead of replacing a response already exposed downstream, while preserving initial response forwarding.

Add handler-level regression coverage for terminal errors and initial non-retryable responses.

* fix: complete upgrade diagnostics lifecycle

Successful CONNECT and protocol upgrades stop before Undici marks the request complete. Diagnostics subscribers retain request state, and streamed request-body listeners remain attached to the upgraded socket.

Publish the existing response lifecycle around accepted upgrades. Preserve the early HTTP/2 CONNECT handoff in v6, and terminate diagnostics if the stream fails before its response.

Refs: #5783
Signed-off-by: Ruben Bridgewater <[email protected]>

* fix: preserve abort after upgrade handoff

Completing upgrade requests suppresses late request errors, but v6 retains the abort callback as the transport cleanup owner after handoff. Returning early leaves upgraded sockets and HTTP/2 CONNECT streams open.

Signed-off-by: Ruben Bridgewater <[email protected]>

---------

Signed-off-by: Ruben Bridgewater <[email protected]>

The test races its forced body timeout against both the first response chunk and a native response-completion timer. A byte-zero retry can succeed, while an early response completion can prevent the expected rejection.

An open RetryAgent can also keep server teardown pending after the assertion completes.

Signed-off-by: Ruben Bridgewater <[email protected]>

Co-authored-by: github-actions <[email protected]>

* fix aborting Streams (#3754)

* fix aborting Streams

* stop memory leak

(cherry picked from commit afeb626)

* test: add regression test for invalid compressed fetch body

A response that advertises content-encoding: gzip but delivers a body
that is not valid gzip in a later packet than the headers left the
body stream pending forever, because the 'terminated' listener had
already been removed in onComplete.

Refs: #5999

---------

Co-authored-by: Austin Henrie <[email protected]>

Co-authored-by: Ulises Gascon <[email protected]>
Signed-off-by: Matteo Collina <[email protected]>
(cherry picked from commit e257e9f)
(cherry picked from commit 12cfd96)

Signed-off-by: Matteo Collina <[email protected]>
(cherry picked from commit f75eac0)
(cherry picked from commit 04cb74b)

Signed-off-by: Matteo Collina <[email protected]>
(cherry picked from commit b5084c7)
(cherry picked from commit 07ded49)

Signed-off-by: Matteo Collina <[email protected]>
(cherry picked from commit 789ef26)
(cherry picked from commit 2991627)

Signed-off-by: Matteo Collina <[email protected]>
(cherry picked from commit b217373)
(cherry picked from commit 5394462)

* Bumped v6.29.1

* test: make security regression tests portable

Signed-off-by: Matteo Collina <[email protected]>
(cherry picked from commit 1a69237)

---------

Signed-off-by: Matteo Collina <[email protected]>
Co-authored-by: github-actions <[email protected]>
Co-authored-by: Matteo Collina <[email protected]>