node:http/http2 hardening: enforce h2 request pseudo-headers, never report a failed handler as success, and bound/validate the parser paths

packages/bun-usockets/src/context.c

@@ -825,3 +825,10 @@ struct us_bun_verify_error_t us_socket_verify_error(struct us_socket_t *s) {
     }
     return (struct us_bun_verify_error_t) { .error = 0, .code = NULL, .reason = NULL };
 }
+
+const char *us_socket_sni_servername(struct us_socket_t *s) {
+    if (s->ssl) {
+        return us_internal_ssl_sni_servername(s);
+    }
+    return NULL;
+}

packages/bun-usockets/src/crypto/openssl.c

@@ -2534,6 +2534,11 @@ void *us_internal_ssl_sni_userdata(struct us_socket_t *s) {
   return us_socket_server_name_userdata(s);
 }
 
+const char *us_internal_ssl_sni_servername(struct us_socket_t *s) {
+  if (!s->ssl || !s_ssl(s)) return NULL;
+  return SSL_get_servername(s_ssl(s), TLSEXT_NAMETYPE_host_name);
+}
+
 void us_internal_listen_socket_ssl_free(struct us_listen_socket_t *ls) {
   /* Accepted sockets carry `ls` in per-SSL ex_data so sni_cb can reach the
    * listener's SNI tree. Those sockets may outlive the listener (server.close()

packages/bun-usockets/src/internal/internal.h

@@ -220,6 +220,7 @@ int us_internal_ssl_write(us_socket_r s, const char *data, int length);
 void *us_internal_ssl_get_native_handle(us_socket_r s);
 struct us_bun_verify_error_t us_internal_ssl_verify_error(us_socket_r s);
 void *us_internal_ssl_sni_userdata(us_socket_r s);
+const char *us_internal_ssl_sni_servername(us_socket_r s);
 void us_internal_ssl_handshake_abort(us_socket_r s);
 /* SSL_CTX_free(ls->ssl_ctx) + sni_free(ls->sni). Called from us_listen_socket_close. */
 void us_internal_listen_socket_ssl_free(struct us_listen_socket_t *ls);

packages/bun-usockets/src/libusockets.h

@@ -406,6 +406,11 @@ unsigned char us_connecting_socket_kind(struct us_connecting_socket_t *c) nonnul
 
 struct us_bun_verify_error_t us_socket_verify_error(struct us_socket_t *s);
 
+/* SNI hostname the peer sent in its ClientHello (server-side TLS sockets), or
+ * NULL when the socket is not TLS or no SNI extension was sent. The returned
+ * pointer is owned by the SSL object and only valid while the socket lives. */
+const char *us_socket_sni_servername(struct us_socket_t *s);
+
 /* ── SSL_CTX construction ─────────────────────────────────────────────────
  * The expensive bit (cert/key/CA parse, cipher list, DH params) is decoupled
  * from sockets entirely. Build once per SecureContext / config, share across

packages/bun-usockets/src/loop.c

@@ -575,6 +575,9 @@ void us_internal_dispatch_ready_poll(struct us_poll_t *p, int error, int eof, in
                 }
 
                 size_t repeat_recv_count = 0;
+                /* Whether this dispatch's read loop delivered any bytes; see the
+                 * hung-up drain and its error handling below. */
+                int read_any = 0;
 
                 do {
                     #ifdef _WIN32
@@ -628,22 +631,36 @@ void us_internal_dispatch_ready_poll(struct us_poll_t *p, int error, int eof, in
                         if(s && s->flags.adopted && s->prev) {
                             s = s->prev;
                         }
+                        read_any = 1;
                         // loop->num_ready_polls isn't accessible on Windows.
                         #ifndef WIN32
                         // rare case: we're reading a lot of data, there's more to be read, and either:
                         // - the socket has hung up, so we will never get more data from it (only applies to macOS, as macOS will send the event the same tick but Linux will not.)
                         // - the event loop isn't very busy, so we can read multiple times in a row
                         #define LOOP_ISNT_VERY_BUSY_THRESHOLD 25
+                        /* Hangup or error flagged on this event (kqueue rides EV_EOF on
+                         * the final data's readable event): no further readable events
+                         * are coming, so drain the kernel buffer now no matter how
+                         * short this read was. Stopping early would let the EOF
+                         * handling below close the socket and discard whatever is
+                         * still queued (a truncated stream). recv() returning 0 or
+                         * EAGAIN ends the loop, so this is bounded by the receive
+                         * buffer. This is what the comment above always described; it
+                         * was keyed on the error flag, which kqueue does not set for
+                         * a peer FIN. */
+                        if (s && !us_socket_is_closed(s) && !s->flags.is_paused && (eof || error)) {
+                            continue;
+                        }
                         /* Stop if on_data paused us (us_socket_pause from the data
                          * handler, e.g. fetch() receive backpressure or
                          * net.Socket#pause) — keep honoring the pause instead of
                          * pulling bytes the caller asked to defer. */
                         if (
                             s && length >= (LIBUS_RECV_BUFFER_LENGTH - 24 * 1024) && length <= LIBUS_RECV_BUFFER_LENGTH &&
-                            (error || loop->num_ready_polls < LOOP_ISNT_VERY_BUSY_THRESHOLD) &&
+                            loop->num_ready_polls < LOOP_ISNT_VERY_BUSY_THRESHOLD &&
                             !us_socket_is_closed(s) && !s->flags.is_paused
                         ) {
-                            repeat_recv_count += error == 0;
+                            repeat_recv_count++;
 
                             // When not hung up, read a maximum of 10 times to avoid starving other sockets
                             // We don't bother with ioctl(FIONREAD) because we've set MSG_DONTWAIT
@@ -675,6 +692,18 @@ void us_internal_dispatch_ready_poll(struct us_poll_t *p, int error, int eof, in
                         eof = 1; // lets handle EOF in the same place
                         break;
                     } else if (length == LIBUS_SOCKET_ERROR && !bsd_would_block()) {
+                        if (eof && read_any) {
+                            /* The hangup drain above already delivered this
+                             * connection's final data and then hit the error queued
+                             * behind its FIN (an RST from the peer tearing down right
+                             * after, often provoked by our own teardown writes). The
+                             * orderly EOF was announced and nothing readable remains:
+                             * report end-of-stream like a reader that stopped at the
+                             * FIN, not a read error. A hard error on the FIRST read of
+                             * a hung-up event (a pure RST: the kernel discards the
+                             * receive queue) still takes the error path below. */
+                            break;
+                        }
                         /* Peer-initiated TCP error (RST etc.) — go straight to
                          * raw-close. us_socket_close() would route through
                          * us_internal_ssl_close() now that s->ssl is the
@@ -693,6 +722,18 @@ void us_internal_dispatch_ready_poll(struct us_poll_t *p, int error, int eof, in
                 } while (s);
             }
 
+            /* kqueue reports EV_EOF on the same readable event as a connection's
+             * final data. If the data callback paused the socket mid-burst (stream
+             * backpressure), the read loop above stopped with bytes still queued in
+             * the kernel, and acting on the hint now would end+close the socket and
+             * discard them. Defer it: resuming re-arms the poll and the EOF is
+             * re-reported once the rest has been read. Sockets we already shut down
+             * are exempt (their peer's FIN must still close them promptly below),
+             * as are error-flagged events. */
+            if (eof && s && !error && s->flags.is_paused && !us_socket_is_shut_down(s) &&
+                !us_socket_is_closed(s)) {
+                eof = 0;
+            }
             if(eof && s) {
                 if (UNLIKELY(us_socket_is_closed(s))) {
                     // Do not call on_end after the socket has been closed

packages/bun-usockets/src/socket.c

@@ -500,10 +500,26 @@ int us_socket_write_check_error(struct us_socket_t *s, const char *data, int len
             us_poll_change(&s->p, s->group->loop, LIBUS_SOCKET_READABLE | LIBUS_SOCKET_WRITABLE);
             return 0;
         }
-        /* Fatal send error (EPIPE/ECONNRESET after the peer vanished): report
-         * it to callers that opt in instead of masking it as would-block, and
-         * do not keep polling writable - retrying can never succeed. */
+#ifndef _WIN32
+        /* libuv treats ENOBUFS like EAGAIN and reports macOS's racy EPROTOTYPE
+         * as ECONNRESET (vendor/libuv/src/unix/stream.c uv__try_write). */
+        if (errno == ENOBUFS) {
+            s->flags.last_write_failed = 1;
+            us_poll_change(&s->p, s->group->loop, LIBUS_SOCKET_READABLE | LIBUS_SOCKET_WRITABLE);
+            return 0;
+        }
+#ifdef __APPLE__
+        if (errno == EPROTOTYPE) errno = ECONNRESET;
+#endif
+        /* Fatal send error: report the errno to callers that opt in and stop
+         * polling writable - retrying can never succeed. */
+        if (fatal_write_error) *fatal_write_error = errno;
+#else
+        /* Windows: no WSA-to-errno mapping yet; signal generic fatal so
+         * node:net fails the write instead of stalling. See a5e7ba5905
+         * before mapping (drain-into-RST on test-http-no-content-length). */
         if (fatal_write_error) *fatal_write_error = 1;
+#endif
         return 0;
     }
     if (written != length) {

packages/bun-uws/src/App.h

@@ -757,6 +757,12 @@ struct TemplatedApp {
         httpContext->getSocketContextData()->onSocketUpgraded = onUpgraded;
     }
 
+    /* Marks this app as backing a node:http server, enabling the per-socket
+     * request timing used by headersTimeout/requestTimeout. */
+    void setUsingNodeHttpCompat(bool value) {
+        httpContext->getSocketContextData()->flags.usingNodeHttpCompat = value;
+    }
+
     TemplatedApp &&run() {
         uWS::run();
         return std::move(*this);
@@ -767,9 +773,11 @@ struct TemplatedApp {
         return std::move(*this);
     }
 
-    TemplatedApp &&setFlags(bool requireHostHeader, bool useStrictMethodValidation) {
+    TemplatedApp &&setFlags(bool requireHostHeader, bool useStrictMethodValidation, bool useInsecureHTTPParser, bool httpAllowHalfOpen) {
         httpContext->getSocketContextData()->flags.requireHostHeader = requireHostHeader;
         httpContext->getSocketContextData()->flags.useStrictMethodValidation = useStrictMethodValidation;
+        httpContext->getSocketContextData()->flags.useInsecureHTTPParser = useInsecureHTTPParser;
+        httpContext->getSocketContextData()->flags.httpAllowHalfOpen = httpAllowHalfOpen;
         return std::move(*this);
     }