Affected URL(s)
https://nodejs.org/docs/latest-v24.x/api/http.html#servermaxheaderscount
https://nodejs.org/docs/latest-v26.x/api/http.html#servermaxheaderscount
Description of the problem
In PR #12039, this limit was raised with the justification that it's set to 2000 in code. However the reference was pointing to the default max header pairs, not header count. Pairs defaults to 2000 here:
|
const MAX_HEADER_PAIRS = 2000; |
Each incoming header consumes two pairs.
Here's a minimal reproduction:
const http = require("http");
const server = http.createServer((req, res) => {
res.writeHead(200);
res.end(String(req.rawHeaders.length << 1)); // this should be the line count
});
server.listen(0, () => {
const port = server.address().port;
const headers = {};
// add 999 headers, bringing total to 1001 including host and connection
// keep size small to not run into size limit
for (let i = 0; i < 999; i++) {
headers[`h-${i}`] = "v";
}
http.get({ port, headers }, (res) => {
let body = "";
res.on("data", (c) => (body += c));
res.on("end", () => {
console.log(`Status: ${res.statusCode}`);
server.close();
});
});
});
I would expect this to work given the stated 2000 default, but I get 431:
$ node --version; node header-count-bug.js
v24.19.0
Status: 431
Affected URL(s)
https://nodejs.org/docs/latest-v24.x/api/http.html#servermaxheaderscount
https://nodejs.org/docs/latest-v26.x/api/http.html#servermaxheaderscount
Description of the problem
In PR #12039, this limit was raised with the justification that it's set to 2000 in code. However the reference was pointing to the default max header pairs, not header count. Pairs defaults to 2000 here:
node/lib/_http_common.js
Line 53 in e65df3b
Each incoming header consumes two pairs.
Here's a minimal reproduction:
I would expect this to work given the stated 2000 default, but I get 431:
$ node --version; node header-count-bug.js v24.19.0 Status: 431