http2: validate initialWindowSize per HTTP/2 spec #61402
Merged
+8
−3
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Collaborator
|
Review requested:
|
nodejs-github-bot
added
http2
The HTTP/2 spec (RFC 7540) defines SETTINGS_INITIAL_WINDOW_SIZE maximum as 2^31-1. Values above this must be treated as a FLOW_CONTROL_ERROR. Previously, Node.js allowed values up to 2^32-1 which caused nghttp2_submit_settings() to return NGHTTP2_ERR_INVALID_ARGUMENT, triggering an uncatchable assertion failure and crashing the process. This change adds proper validation to reject values >= 2^31 with a catchable RangeError before they reach nghttp2.
mcollina
force-pushed
the
fix-http2-initial-window-size-validation
branch
from
9a664ef to
7fd969e
Compare
RafaelGSS
approved these changes
Jan 16, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #61402 +/- ##
=======================================
Coverage 88.54% 88.54%
=======================================
Files 704 704
Lines 208806 208807 +1
Branches 40316 40323 +7
=======================================
+ Hits 184878 184887 +9
+ Misses 15914 15910 -4
+ Partials 8014 8010 -4
🚀 New features to boost your workflow:
|
lpinca
approved these changes
Jan 16, 2026
Contributor
|
great catch aligning this with RFC 7540 the new RangeError makes the failure mode predictable and user-catchable, and the added test coverage looks solid. |
Qard
approved these changes
Jan 17, 2026
github-actions
bot
removed
the
request-ci
Collaborator
cjihrig
approved these changes
Jan 17, 2026
atlowChemi
approved these changes
Jan 17, 2026
pimterry
approved these changes
Jan 18, 2026
github-actions
bot
removed
the
request-ci
Collaborator
Collaborator
mcollina
added
lts-watch-v20.x
nodejs-github-bot
removed
the
commit-queue
Collaborator
|
Landed in 57a71cd |
aduh95
pushed a commit
that referenced
this pull request
Jan 20, 2026
The HTTP/2 spec (RFC 7540) defines SETTINGS_INITIAL_WINDOW_SIZE maximum as 2^31-1. Values above this must be treated as a FLOW_CONTROL_ERROR. Previously, Node.js allowed values up to 2^32-1 which caused nghttp2_submit_settings() to return NGHTTP2_ERR_INVALID_ARGUMENT, triggering an uncatchable assertion failure and crashing the process. This change adds proper validation to reject values >= 2^31 with a catchable RangeError before they reach nghttp2. PR-URL: #61402 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il> Reviewed-By: Tim Perry <pimterry@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
9 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The HTTP/2 spec (RFC 7540) defines SETTINGS_INITIAL_WINDOW_SIZE maximum as 2^31-1. Values above this must be treated as a FLOW_CONTROL_ERROR. Previously, Node.js allowed values up to 2^32-1 which caused nghttp2_submit_settings() to return NGHTTP2_ERR_INVALID_ARGUMENT, triggering an uncatchable assertion failure and crashing the process.
This change adds proper validation to reject values >= 2^31 with a catchable RangeError before they reach nghttp2.