Matteo Collina c79968e108 http2: cap originSet size to prevent unbounded memory growth ...

A malicious HTTP/2 server can send repeated ORIGIN frames with unique
origins, causing unbounded growth of the client-side originSet for the
lifetime of the session. Cap the set at 128 entries; once full, new
origins from ORIGIN frames are silently dropped.

Ref: https://hackerone.com/reports/3676863
PR-URL: https://github.com/nodejs-private/node-private/pull/855
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48619
Refs: https://hackerone.com/reports/3676863

2026-06-17 19:52:19 +02:00

..

addons.md

doc: fix c++ addon hello world sample

2025-01-05 13:05:24 -05:00

assert.md

doc: mention constructor comparison in assert.deepStrictEqual

2026-02-24 08:39:01 +01:00

async_context.md

doc: fix AsyncLocalStorage example response changes after node v18

2025-05-19 12:14:09 +02:00

async_hooks.md

doc,tools: enforce use of node: prefix

2024-08-05 11:15:41 -03:00

buffer.md

doc: clarify TypedArray properties on Buffer

2026-02-24 08:38:59 +01:00

child_process.md

doc: recommend events.once to manage 'close' event

2026-02-24 00:36:42 +01:00

cli.md

2026-03-05, Version 22.22.1 'Jod' (LTS)

2026-03-04 10:24:57 +01:00

cluster.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

console.md

doc: add a note on console stream behavior

2025-01-05 12:57:20 -05:00

corepack.md

doc: clarify future Corepack removal in v25+

2025-06-10 10:39:39 +02:00

crypto.md

doc: rename x509.extKeyUsage to x509.keyUsage

2025-08-26 11:22:41 +02:00

debugger.md

doc,src,test: fix dead inspector help URL

2026-05-11 18:27:28 +02:00

deprecations.md

http2: remove support for priority signaling

2026-06-16 14:24:43 +02:00

dgram.md

doc: add reusePort error behavior to net module

2026-02-24 00:37:13 +01:00

diagnostics_channel.md

http2: add diagnostics channels for client stream request body

2026-02-24 00:36:28 +01:00

dns.md

doc: add missing CAA type to dns.resolveAny() & dnsPromises.resolveAny()

2026-02-19 18:46:21 +01:00

documentation.md

doc: clarify release candidate stability index

2025-08-26 11:22:37 +02:00

domain.md

doc: domain.add() does not accept timer objects

2026-02-24 00:36:55 +01:00

embedding.md

doc: improve c++ embedder API doc

2024-11-27 11:03:27 -05:00

environment_variables.md

doc: fix small environment_variables typo

2026-05-11 16:10:17 +02:00

errors.md

http2: cap originSet size to prevent unbounded memory growth

2026-06-17 19:52:19 +02:00

esm.md

doc: fix small logic error in DETECT_MODULE_SYNTAX

2026-05-11 16:10:16 +02:00

events.md

doc: clarify async caveats for events.once()

2026-05-11 16:10:18 +02:00

fs.md

doc: clarify fs.ReadStream and fs.WriteStream are not constructable

2026-05-11 16:16:22 +02:00

globals.md

doc: update MDN links

2026-02-24 08:38:53 +01:00

http2.md

http2: cap originSet size to prevent unbounded memory growth

2026-06-17 19:52:19 +02:00

http.md

doc: fix overstated Date header requirement in response.sendDate

2026-05-11 16:10:17 +02:00

https.md

doc: fix linter issues

2026-02-24 00:36:43 +01:00

index.md

doc: add new environment variables doc page

2025-09-20 03:32:45 +00:00

inspector.md

doc,src,test: fix dead inspector help URL

2026-05-11 18:27:28 +02:00

intl.md

doc: update MDN links

2026-02-24 08:38:53 +01:00

module.md

doc: fix module.stripTypeScriptTypes indentation

2026-05-11 16:16:21 +02:00

modules.md

doc: fix pseudo code in modules.md

2026-02-24 00:36:42 +01:00

n-api.md

2025-10-20, Version 22.21.0 'Jod' (LTS)

2025-10-19 00:35:43 +02:00

net.md

doc: fix broken links of net.md

2026-05-11 15:50:08 +02:00

os.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

packages.md

doc: packages: example of private import switch to internal

2026-02-24 08:38:55 +01:00

path.md

2025-09-24, Version 22.20.0 'Jod' (LTS)

2025-09-22 18:39:21 +00:00

perf_hooks.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

permissions.md

permission: propagate permission model flags on spawn

2025-07-27 20:28:14 +02:00

process.md

doc: fix methods being documented as properties in process.md

2026-05-11 16:10:15 +02:00

punycode.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

querystring.md

doc: get rid of unnecessary eslint-skip comments

2023-11-22 19:03:33 +00:00

readline.md

doc: document error event on readline InterfaceConstructor

2026-02-24 00:37:10 +01:00

repl.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

report.md

2025-01-07, Version 22.13.0 'Jod' (LTS)

2025-01-06 10:57:22 -05:00

single-executable-applications.md

doc: add missing word in single-executable-applications.md

2026-02-24 00:36:41 +01:00

sqlite.md

doc: rename invalid function parameter

2026-05-11 16:16:21 +02:00

stream.md

doc: instantiate resolver object

2026-02-24 00:36:28 +01:00

string_decoder.md

doc: add esm examples to node:string_decoder

2024-11-27 11:03:25 -05:00

synopsis.md

doc: clarify explaination text on how to run the example

2023-10-06 13:37:31 +00:00

test.md

doc: add note (and caveat) for mock.module about customization hooks

2026-05-11 16:16:22 +02:00

timers.md

doc: add esm examples to node:timers

2025-01-05 12:57:23 -05:00

tls.md

doc: added requestOCSP option to tls.connect

2026-02-24 08:39:01 +01:00

tracing.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

tty.md

doc: fix typed list formatting

2025-08-04 13:29:03 +02:00

typescript.md

doc: remove incorrect mention of module in typescript.md

2026-05-11 16:16:21 +02:00

url.md

doc: add deprecation history for url.parse

2026-02-24 08:38:57 +01:00

util.md

doc: update MDN links

2026-02-24 08:38:53 +01:00

v8.md

doc: add esm and cjs examples to node:v8

2026-02-24 08:38:55 +01:00

vm.md

vm: make vm.Module.evaluate() conditionally synchronous

2026-02-19 18:46:01 +01:00

wasi.md

doc: update MDN links

2026-02-24 08:38:53 +01:00

webcrypto.md

doc,crypto: update subtle.generateKey and subtle.importKey

2025-10-11 20:49:13 +02:00

webstreams.md

2025-09-24, Version 22.20.0 'Jod' (LTS)

2025-09-22 18:39:21 +00:00

worker_threads.md

doc: update MDN links

2026-02-24 08:38:53 +01:00

zlib.md

doc: add missing zstd to mjs example of zlib

2026-02-24 00:37:03 +01:00