Matteo Collina 65a3ab3264 http2: cap originSet size to prevent unbounded memory growth ...

A malicious HTTP/2 server can send repeated ORIGIN frames with unique
origins, causing unbounded growth of the client-side originSet for the
lifetime of the session. Cap the set at 128 entries; once full, new
origins from ORIGIN frames are silently dropped.

Refs: https://hackerone.com/reports/3676863
PR-URL: https://github.com/nodejs-private/node-private/pull/855
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48619

2026-06-18 06:29:23 +02:00

..

addons.md

src: officially deprecate node::ObjectWrap

2026-06-13 23:12:14 +00:00

assert.md

…

async_context.md

…

async_hooks.md

…

buffer.md

…

child_process.md

…

cli.md

doc: fix typo in cli.md

2026-06-15 09:42:39 +00:00

cluster.md

…

console.md

…

crypto.md

crypto: move DEP0203 and DEP0204 to End-of-Life

2026-06-17 17:18:40 +00:00

debugger.md

debugger: add --max-hit option to probe mode

2026-06-13 20:50:15 +00:00

deprecations.md

crypto: move DEP0203 and DEP0204 to End-of-Life

2026-06-17 17:18:40 +00:00

dgram.md

dgram: add synchronous Socket connectSync()

2026-06-17 19:09:05 +00:00

diagnostics_channel.md

…

dns.md

…

documentation.md

…

domain.md

…

dtls.md

…

embedding.md

…

environment_variables.md

…

errors.md

http2: cap originSet size to prevent unbounded memory growth

2026-06-18 06:29:23 +02:00

esm.md

loader: implement package maps

2026-06-12 16:02:01 +00:00

events.md

…

ffi.md

ffi: add experimental fast FFI call API for AArch64 and x86_64

2026-06-16 09:35:02 +00:00

fs.md

fs: support caller-supplied readFile() buffers

2026-06-13 10:08:05 +00:00

globals.md

…

http2.md

http2: cap originSet size to prevent unbounded memory growth

2026-06-18 06:29:23 +02:00

http.md

net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive

2026-06-13 23:12:25 +00:00

https.md

…

index.md

…

inspector.md

…

intl.md

…

module.md

…

modules.md

loader: implement package maps

2026-06-12 16:02:01 +00:00

n-api.md

…

net.md

net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive

2026-06-13 23:12:25 +00:00

os.md

…

packages.md

doc: fix typo in packages.md

2026-06-12 21:08:07 +00:00

path.md

…

perf_hooks.md

…

permissions.md

…

process.md

…

punycode.md

…

querystring.md

…

quic.md

…

readline.md

…

repl.md

…

report.md

…

single-executable-applications.md

…

sqlite.md

…

stream_iter.md

stream: refine the stream/iter backpressure

2026-06-17 16:08:46 +00:00

stream.md

…

string_decoder.md

…

synopsis.md

…

test.md

doc: fix incorrect test runner mock examples

2026-06-17 09:11:36 +00:00

timers.md

…

tls.md

…

tracing.md

…

tty.md

…

typescript.md

…

url.md

…

util.md

…

v8.md

…

vfs.md

…

vm.md

doc: fix typo in vm.md

2026-06-12 21:45:48 +00:00

wasi.md

…

webcrypto.md

…

webstreams.md

…

worker_threads.md

…

zlib.md

…