https: limit proxy CONNECT response headers by mcollina · Pull Request #64545 · nodejs/node

mcollina · 2026-07-16T19:36:16Z

enforce the effective HTTP maximum header size while reading HTTPS proxy CONNECT responses
use a one-shot readable listener while waiting for additional response data
add regression coverage for fragmented, incomplete proxy response headers

Apply the configured maximum header size while reading CONNECT responses. Rearm the readable listener only once per read pass to avoid unbounded buffer and listener growth. Signed-off-by: Matteo Collina <hello@matteocollina.com>

nodejs-github-bot · 2026-07-16T19:36:21Z

Review requested:

@nodejs/crypto
@nodejs/http
@nodejs/net

codecov · 2026-07-16T21:12:43Z

Codecov Report

❌ Patch coverage is 95.83333% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.28%. Comparing base (cf882a7) to head (34ef7aa).
⚠️ Report is 770 commits behind head on main.

Files with missing lines	Patch %	Lines
lib/https.js	95.83%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #64545      +/-   ##
==========================================
+ Coverage   90.24%   90.28%   +0.04%     
==========================================
  Files         739      762      +23     
  Lines      241667   247537    +5870     
  Branches    45550    46690    +1140     
==========================================
+ Hits       218093   223501    +5408     
- Misses      15109    15480     +371     
- Partials     8465     8556      +91

Files with missing lines	Coverage Δ
lib/https.js	`97.18% <95.83%> (-1.05%)`	⬇️

... and 201 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-07-17T12:34:25Z

CI: https://ci.nodejs.org/job/node-test-pull-request/74869/

Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>

nodejs-github-bot · 2026-08-06T23:37:20Z

CI: https://ci.nodejs.org/job/node-test-pull-request/75591/

nodejs-github-bot · 2026-09-02T05:27:18Z

CI: https://ci.nodejs.org/job/node-test-pull-request/76870/

nodejs-github-bot · 2026-09-03T05:36:26Z

Commit Queue failed

✘ GitHub CI is still running

The pull request was removed from the Commit Queue and labeled commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. . After resolving the failure, remove that label and add commit-queue PRs queued for automated landing through the Commit Queue. to retry.

Full Commit Queue output

- Loading data for nodejs/node/pull/64545
✔  Done loading data for nodejs/node/pull/64545
----------------------------------- PR info ------------------------------------
Title      https: limit proxy CONNECT response headers (#64545)
Author     Matteo Collina <matteo.collina@gmail.com> (@mcollina)
Branch     mcollina:fix/https-proxy-connect-header-limit -> nodejs:main
Labels     https, needs-ci, commit-queue
Commits    2
 - https: limit proxy CONNECT response headers
 - Update https.js
Committers 1
 - Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/64545
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/64545
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Thu, 16 Jul 2026 19:36:16 GMT
   ✔  Approvals: 3
   ✔  - Tim Perry (@pimterry): https://github.com/nodejs/node/pull/64545#pullrequestreview-4722448442
   ✔  - James M Snell (@jasnell) (TSC): https://github.com/nodejs/node/pull/64545#pullrequestreview-4731343539
   ✔  - Joyee Cheung (@joyeecheung) (TSC): https://github.com/nodejs/node/pull/64545#pullrequestreview-4877655248
   ✘  GitHub CI is still running
   ℹ  Last Full PR CI on 2026-09-02T05:27:18Z: https://ci.nodejs.org/job/node-test-pull-request/76870/
- Querying data for job/node-test-pull-request/76870/
✔  Build data downloaded
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  Aborted `git node land` session in /home/runner/work/node/node/.ncu

View workflow run

nodejs-github-bot · 2026-09-03T13:49:56Z

Commit Queue failed

✘ GitHub CI is still running

The pull request was removed from the Commit Queue and labeled commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. . After resolving the failure, remove that label and add commit-queue PRs queued for automated landing through the Commit Queue. to retry.

Full Commit Queue output

- Loading data for nodejs/node/pull/64545
✔  Done loading data for nodejs/node/pull/64545
----------------------------------- PR info ------------------------------------
Title      https: limit proxy CONNECT response headers (#64545)
Author     Matteo Collina <matteo.collina@gmail.com> (@mcollina)
Branch     mcollina:fix/https-proxy-connect-header-limit -> nodejs:main
Labels     https, needs-ci, commit-queue
Commits    2
 - https: limit proxy CONNECT response headers
 - Update https.js
Committers 1
 - Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/64545
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/64545
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Thu, 16 Jul 2026 19:36:16 GMT
   ✔  Approvals: 3
   ✔  - Tim Perry (@pimterry): https://github.com/nodejs/node/pull/64545#pullrequestreview-4722448442
   ✔  - James M Snell (@jasnell) (TSC): https://github.com/nodejs/node/pull/64545#pullrequestreview-4731343539
   ✔  - Joyee Cheung (@joyeecheung) (TSC): https://github.com/nodejs/node/pull/64545#pullrequestreview-4877655248
   ✘  GitHub CI is still running
   ℹ  Last Full PR CI on 2026-09-03T05:36:26Z: https://ci.nodejs.org/job/node-test-pull-request/76870/
- Querying data for job/node-test-pull-request/76870/
✔  Build data downloaded
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  Aborted `git node land` session in /home/runner/work/node/node/.ncu

View workflow run

Apply the configured maximum header size while reading CONNECT responses. Rearm the readable listener only once per read pass to avoid unbounded buffer and listener growth. Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: #64545 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

mcollina · 2026-09-03T13:56:53Z

Landed in 84e3675

Apply the configured maximum header size while reading CONNECT responses. Rearm the readable listener only once per read pass to avoid unbounded buffer and listener growth. Signed-off-by: Matteo Collina <hello@matteocollina.com> PR-URL: #64545 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

https: limit proxy CONNECT response headers

6c6d170

Apply the configured maximum header size while reading CONNECT responses. Rearm the readable listener only once per read pass to avoid unbounded buffer and listener growth. Signed-off-by: Matteo Collina <hello@matteocollina.com>

nodejs-github-bot added https Issues and PRs related to the https subsystem. needs-ci PRs that need a full CI run. labels Jul 16, 2026

mcollina marked this pull request as ready for review July 16, 2026 19:37

pimterry approved these changes Jul 17, 2026

View reviewed changes

pimterry added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Jul 17, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Jul 17, 2026

mcollina requested a review from joyeecheung July 17, 2026 13:07

joyeecheung reviewed Jul 17, 2026

View reviewed changes

Comment thread lib/https.js Outdated

Comment thread lib/https.js Outdated

jasnell approved these changes Jul 19, 2026

View reviewed changes

Update https.js

34ef7aa

Co-authored-by: Joyee Cheung <joyeec9h3@gmail.com>

mcollina force-pushed the fix/https-proxy-connect-header-limit branch from 215d5d9 to 34ef7aa Compare August 3, 2026 15:25

joyeecheung approved these changes Aug 6, 2026

View reviewed changes

joyeecheung added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Aug 6, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Aug 6, 2026

mcollina added the commit-queue PRs queued for automated landing through the Commit Queue. label Sep 3, 2026

nodejs-github-bot added commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. and removed commit-queue PRs queued for automated landing through the Commit Queue. labels Sep 3, 2026

richardlau added commit-queue PRs queued for automated landing through the Commit Queue. and removed commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. labels Sep 3, 2026

nodejs-github-bot added commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. and removed commit-queue PRs queued for automated landing through the Commit Queue. labels Sep 3, 2026

mcollina closed this Sep 3, 2026

mcollina added the commit-queue-squash PRs the Commit Queue should land as one squashed commit. label Sep 3, 2026

github-actions Bot mentioned this pull request Sep 7, 2026

2026-09-08, Version 26.9.0 (Current) #65881

Open

Navigation Menu

Uh oh!

Uh oh!

https: limit proxy CONNECT response headers - #64545

https: limit proxy CONNECT response headers#64545
mcollina wants to merge 2 commits into
nodejs:mainfrom
mcollina:fix/https-proxy-connect-header-limit

mcollina commented Jul 16, 2026 •

edited

Loading

Uh oh!

nodejs-github-bot commented Jul 16, 2026

Uh oh!

codecov Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

nodejs-github-bot commented Jul 17, 2026

Uh oh!

Uh oh!

Uh oh!

nodejs-github-bot commented Aug 6, 2026

Uh oh!

nodejs-github-bot commented Sep 2, 2026

Uh oh!

nodejs-github-bot commented Sep 3, 2026

Uh oh!

nodejs-github-bot commented Sep 3, 2026

Uh oh!

mcollina commented Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Uh oh!

Conversation

mcollina commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Jul 16, 2026

Uh oh!

codecov Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

nodejs-github-bot commented Jul 17, 2026

Uh oh!

Uh oh!

Uh oh!

nodejs-github-bot commented Aug 6, 2026

Uh oh!

nodejs-github-bot commented Sep 2, 2026

Uh oh!

nodejs-github-bot commented Sep 3, 2026

Commit Queue failed

Uh oh!

nodejs-github-bot commented Sep 3, 2026

Commit Queue failed

Uh oh!

mcollina commented Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

mcollina commented Jul 16, 2026 •

edited

Loading

codecov Bot commented Jul 16, 2026 •

edited

Loading