Skip to content

Commit 064d339

Browse files
mcollinaRafaelGSS
mcollina
authored and
RafaelGSS
committed
http: reject requests exceeding max header count
PR-URL: nodejs-private/node-private#922 Refs: https://hackerone.com/reports/3564941 CVE-ID: CVE-2026-58044
1 parent ad99d07 commit 064d339

5 files changed

Lines changed: 126 additions & 56 deletions

‎src/node_http_parser.cc‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -375,6 +375,11 @@ class Parser : public AsyncWrap, public StreamListener {
375375

376376
if (num_fields_ == num_values_) {
377377
// start of new field name
378+
rv = TrackHeaderPair();
379+
if (rv != 0) {
380+
return rv;
381+
}
382+
378383
num_fields_++;
379384
if (num_fields_ == kMaxHeaderFieldsCount) {
380385
// ran out of space - flush to javascript land
@@ -459,6 +464,7 @@ class Parser : public AsyncWrap, public StreamListener {
459464

460465
num_fields_ = 0;
461466
num_values_ = 0;
467+
header_pairs_ = 0;
462468

463469
// METHOD
464470
if (parser_.type == HTTP_REQUEST) {
@@ -552,6 +558,8 @@ class Parser : public AsyncWrap, public StreamListener {
552558
if (num_fields_)
553559
Flush(); // Flush trailing HTTP headers.
554560

561+
header_pairs_ = 0;
562+
555563
Local<Object> obj = object();
556564
Local<Value> cb = obj->Get(env()->context(),
557565
kOnMessageComplete).ToLocalChecked();
@@ -1025,6 +1033,7 @@ class Parser : public AsyncWrap, public StreamListener {
10251033
is_being_freed_ = false;
10261034
headers_completed_ = false;
10271035
max_http_header_size_ = max_http_header_size;
1036+
header_pairs_ = 0;
10281037
}
10291038

10301039

@@ -1037,6 +1046,34 @@ class Parser : public AsyncWrap, public StreamListener {
10371046
return 0;
10381047
}
10391048

1049+
int TrackHeaderPair() {
1050+
if (parser_.type != HTTP_REQUEST) {
1051+
return 0;
1052+
}
1053+
1054+
header_pairs_ += 2;
1055+
1056+
Local<Value> max_header_pairs_v;
1057+
if (!object()
1058+
->Get(env()->context(),
1059+
FIXED_ONE_BYTE_STRING(env()->isolate(), "maxHeaderPairs"))
1060+
.ToLocal(&max_header_pairs_v)) {
1061+
got_exception_ = true;
1062+
return -1;
1063+
}
1064+
1065+
if (!max_header_pairs_v->IsNumber()) {
1066+
return 0;
1067+
}
1068+
1069+
const double max_header_pairs = max_header_pairs_v.As<Number>()->Value();
1070+
if (max_header_pairs > 0 && header_pairs_ > max_header_pairs) {
1071+
llhttp_set_error_reason(&parser_, "HPE_HEADER_OVERFLOW:Header overflow");
1072+
return HPE_USER;
1073+
}
1074+
1075+
return 0;
1076+
}
10401077

10411078
int MaybePause() {
10421079
if (!pending_pause_) {
@@ -1071,6 +1108,7 @@ class Parser : public AsyncWrap, public StreamListener {
10711108
size_t current_buffer_len_;
10721109
const char* current_buffer_data_;
10731110
bool headers_completed_ = false;
1111+
size_t header_pairs_ = 0;
10741112
bool pending_pause_ = false;
10751113
bool received_data_ = false;
10761114
uint64_t header_nread_ = 0;

‎test/parallel/test-http-max-headers-count-overflow.js‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
'use strict';
2+
const common = require('../common');
3+
const assert = require('assert');
4+
const http = require('http');
5+
const net = require('net');
6+
7+
const server = http.createServer(common.mustNotCall());
8+
9+
server.maxHeadersCount = 2;
10+
11+
server.on('clientError', common.mustCall((err, socket) => {
12+
assert.strictEqual(err.code, 'HPE_HEADER_OVERFLOW');
13+
socket.end('HTTP/1.1 431 Request Header Fields Too Large\r\n\r\n');
14+
}));
15+
16+
server.listen(0, common.mustCall(() => {
17+
const port = server.address().port;
18+
const req = 'POST / HTTP/1.1\r\n' +
19+
'Host: localhost\r\n' +
20+
'X-A: b\r\n' +
21+
'Content-Length: 3\r\n' +
22+
'\r\nabc';
23+
24+
net.createConnection(port, 'localhost', common.mustCall(function() {
25+
let response = '';
26+
this.setEncoding('latin1');
27+
this.end(req);
28+
this.on('data', (chunk) => response += chunk);
29+
this.on('end', common.mustCall(() => {
30+
assert.match(response, /^HTTP\/1\.1 431 /);
31+
server.close();
32+
}));
33+
}));
34+
}));

‎test/parallel/test-http-max-headers-count.js‎

Lines changed: 28 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -35,19 +35,29 @@ for (let i = 0; i < N; ++i) {
3535
headers[`key${i}`] = i;
3636
}
3737

38-
const maxAndExpected = [ // for server
39-
[50, 50],
40-
[1500, 102],
41-
[0, N + 2], // Host and Connection
38+
function createRequestHeaders(count) {
39+
const requestHeaders = {
40+
host: 'example.com',
41+
};
42+
for (let i = 0; i < count; ++i) {
43+
requestHeaders[`key${i}`] = i;
44+
}
45+
return requestHeaders;
46+
}
47+
48+
const serverMaxAndExpected = [ // for server
49+
[50, 50, 48],
50+
[1500, 102, N],
51+
[0, N + 2, N], // Host and Connection
4252
];
43-
let max = maxAndExpected[requests][0];
44-
let expected = maxAndExpected[requests][1];
53+
let max = serverMaxAndExpected[requests][0];
54+
let expected = serverMaxAndExpected[requests][1];
4555

4656
const server = http.createServer(common.mustCallAtLeast((req, res) => {
4757
assert.strictEqual(Object.keys(req.headers).length, expected);
48-
if (++requests < maxAndExpected.length) {
49-
max = maxAndExpected[requests][0];
50-
expected = maxAndExpected[requests][1];
58+
if (++requests < serverMaxAndExpected.length) {
59+
max = serverMaxAndExpected[requests][0];
60+
expected = serverMaxAndExpected[requests][1];
5161
server.maxHeadersCount = max;
5262
}
5363
res.writeHead(200, { ...headers, 'Connection': 'close' });
@@ -56,23 +66,25 @@ const server = http.createServer(common.mustCallAtLeast((req, res) => {
5666
server.maxHeadersCount = max;
5767

5868
server.listen(0, common.mustCall(() => {
59-
const maxAndExpected = [ // for client
69+
const clientMaxAndExpected = [ // for client
6070
[20, 20],
6171
[1200, 104],
6272
[0, N + 4], // Host and Connection
6373
];
6474
doRequest();
6575

6676
function doRequest() {
67-
const max = maxAndExpected[responses][0];
68-
const expected = maxAndExpected[responses][1];
77+
const max = clientMaxAndExpected[responses][0];
78+
const expected = clientMaxAndExpected[responses][1];
79+
const requestHeaders =
80+
createRequestHeaders(serverMaxAndExpected[requests][2]);
6981
const req = http.request({
7082
port: server.address().port,
71-
headers: headers
83+
headers: requestHeaders
7284
}, common.mustCall((res) => {
7385
assert.strictEqual(Object.keys(res.headers).length, expected);
7486
res.on('end', function() {
75-
if (++responses < maxAndExpected.length) {
87+
if (++responses < clientMaxAndExpected.length) {
7688
doRequest();
7789
} else {
7890
server.close();
@@ -86,6 +98,6 @@ server.listen(0, common.mustCall(() => {
8698
}));
8799

88100
process.on('exit', function() {
89-
assert.strictEqual(requests, maxAndExpected.length);
90-
assert.strictEqual(responses, maxAndExpected.length);
101+
assert.strictEqual(requests, serverMaxAndExpected.length);
102+
assert.strictEqual(responses, serverMaxAndExpected.length);
91103
});

‎test/parallel/test-http-rawheaders-limit.js‎

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎test/parallel/test-https-max-headers-count.js‎

Lines changed: 26 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -24,19 +24,29 @@ for (let i = 0; i < N; ++i) {
2424
headers[`key${i}`] = i;
2525
}
2626

27-
const maxAndExpected = [ // for server
28-
[50, 50],
29-
[1500, 102],
30-
[0, N + 2], // Host and Connection
27+
function createRequestHeaders(count) {
28+
const requestHeaders = {
29+
host: 'example.com',
30+
};
31+
for (let i = 0; i < count; ++i) {
32+
requestHeaders[`key${i}`] = i;
33+
}
34+
return requestHeaders;
35+
}
36+
37+
const serverMaxAndExpected = [ // for server
38+
[50, 50, 48],
39+
[1500, 102, N],
40+
[0, N + 2, N], // Host and Connection
3141
];
32-
let max = maxAndExpected[requests][0];
33-
let expected = maxAndExpected[requests][1];
42+
let max = serverMaxAndExpected[requests][0];
43+
let expected = serverMaxAndExpected[requests][1];
3444

3545
const server = https.createServer(serverOptions, common.mustCall((req, res) => {
3646
assert.strictEqual(Object.keys(req.headers).length, expected);
37-
if (++requests < maxAndExpected.length) {
38-
max = maxAndExpected[requests][0];
39-
expected = maxAndExpected[requests][1];
47+
if (++requests < serverMaxAndExpected.length) {
48+
max = serverMaxAndExpected[requests][0];
49+
expected = serverMaxAndExpected[requests][1];
4050
server.maxHeadersCount = max;
4151
}
4252
res.writeHead(200, { ...headers, 'Connection': 'close' });
@@ -45,22 +55,24 @@ const server = https.createServer(serverOptions, common.mustCall((req, res) => {
4555
server.maxHeadersCount = max;
4656

4757
server.listen(0, common.mustCall(() => {
48-
const maxAndExpected = [ // for client
58+
const clientMaxAndExpected = [ // for client
4959
[20, 20],
5060
[1200, 104],
5161
[0, N + 4], // Host and Connection
5262
];
5363
const doRequest = common.mustCall(() => {
54-
const max = maxAndExpected[responses][0];
55-
const expected = maxAndExpected[responses][1];
64+
const max = clientMaxAndExpected[responses][0];
65+
const expected = clientMaxAndExpected[responses][1];
66+
const requestHeaders =
67+
createRequestHeaders(serverMaxAndExpected[requests][2]);
5668
const req = https.request({
5769
port: server.address().port,
58-
headers: headers,
70+
headers: requestHeaders,
5971
rejectUnauthorized: false
6072
}, common.mustCall((res) => {
6173
assert.strictEqual(Object.keys(res.headers).length, expected);
6274
res.on('end', () => {
63-
if (++responses < maxAndExpected.length) {
75+
if (++responses < clientMaxAndExpected.length) {
6476
doRequest();
6577
} else {
6678
server.close();

0 commit comments

Comments
 (0)