node:http/http2 hardening: enforce h2 request pseudo-headers, never report a failed handler as success, and bound/validate the parser paths

packages/bun-usockets/src/context.c

@@ -822,3 +822,10 @@ struct us_bun_verify_error_t us_socket_verify_error(struct us_socket_t *s) {
     }
     return (struct us_bun_verify_error_t) { .error = 0, .code = NULL, .reason = NULL };
 }
+
+const char *us_socket_sni_servername(struct us_socket_t *s) {
+    if (s->ssl) {
+        return us_internal_ssl_sni_servername(s);
+    }
+    return NULL;
+}

packages/bun-usockets/src/crypto/openssl.c

@@ -2496,6 +2496,11 @@ void *us_internal_ssl_sni_userdata(struct us_socket_t *s) {
   return us_socket_server_name_userdata(s);
 }
 
+const char *us_internal_ssl_sni_servername(struct us_socket_t *s) {
+  if (!s->ssl || !s_ssl(s)) return NULL;
+  return SSL_get_servername(s_ssl(s), TLSEXT_NAMETYPE_host_name);
+}
+
 void us_internal_listen_socket_ssl_free(struct us_listen_socket_t *ls) {
   /* Accepted sockets carry `ls` in per-SSL ex_data so sni_cb can reach the
    * listener's SNI tree. Those sockets may outlive the listener (server.close()

packages/bun-usockets/src/internal/internal.h

@@ -215,6 +215,7 @@ int us_internal_ssl_write(us_socket_r s, const char *data, int length);
 void *us_internal_ssl_get_native_handle(us_socket_r s);
 struct us_bun_verify_error_t us_internal_ssl_verify_error(us_socket_r s);
 void *us_internal_ssl_sni_userdata(us_socket_r s);
+const char *us_internal_ssl_sni_servername(us_socket_r s);
 void us_internal_ssl_handshake_abort(us_socket_r s);
 /* SSL_CTX_free(ls->ssl_ctx) + sni_free(ls->sni). Called from us_listen_socket_close. */
 void us_internal_listen_socket_ssl_free(struct us_listen_socket_t *ls);

packages/bun-usockets/src/libusockets.h

@@ -406,6 +406,11 @@ unsigned char us_connecting_socket_kind(struct us_connecting_socket_t *c) nonnul
 
 struct us_bun_verify_error_t us_socket_verify_error(struct us_socket_t *s);
 
+/* SNI hostname the peer sent in its ClientHello (server-side TLS sockets), or
+ * NULL when the socket is not TLS or no SNI extension was sent. The returned
+ * pointer is owned by the SSL object and only valid while the socket lives. */
+const char *us_socket_sni_servername(struct us_socket_t *s);
+
 /* ── SSL_CTX construction ─────────────────────────────────────────────────
  * The expensive bit (cert/key/CA parse, cipher list, DH params) is decoupled
  * from sockets entirely. Build once per SecureContext / config, share across

packages/bun-usockets/src/loop.c

@@ -572,6 +572,9 @@ void us_internal_dispatch_ready_poll(struct us_poll_t *p, int error, int eof, in
                 }
 
                 size_t repeat_recv_count = 0;
+                /* Whether this dispatch's read loop delivered any bytes; see the
+                 * hung-up drain and its error handling below. */
+                int read_any = 0;
 
                 do {
                     #ifdef _WIN32
@@ -625,22 +628,36 @@ void us_internal_dispatch_ready_poll(struct us_poll_t *p, int error, int eof, in
                         if(s && s->flags.adopted && s->prev) {
                             s = s->prev;
                         }
+                        read_any = 1;
                         // loop->num_ready_polls isn't accessible on Windows.
                         #ifndef WIN32
                         // rare case: we're reading a lot of data, there's more to be read, and either:
                         // - the socket has hung up, so we will never get more data from it (only applies to macOS, as macOS will send the event the same tick but Linux will not.)
                         // - the event loop isn't very busy, so we can read multiple times in a row
                         #define LOOP_ISNT_VERY_BUSY_THRESHOLD 25
+                        /* Hangup or error flagged on this event (kqueue rides EV_EOF on
+                         * the final data's readable event): no further readable events
+                         * are coming, so drain the kernel buffer now no matter how
+                         * short this read was. Stopping early would let the EOF
+                         * handling below close the socket and discard whatever is
+                         * still queued (a truncated stream). recv() returning 0 or
+                         * EAGAIN ends the loop, so this is bounded by the receive
+                         * buffer. This is what the comment above always described; it
+                         * was keyed on the error flag, which kqueue does not set for
+                         * a peer FIN. */
+                        if (s && !us_socket_is_closed(s) && !s->flags.is_paused && (eof || error)) {
+                            continue;
+                        }
                         /* Stop if on_data paused us (us_socket_pause from the data
                          * handler, e.g. fetch() receive backpressure or
                          * net.Socket#pause) — keep honoring the pause instead of
                          * pulling bytes the caller asked to defer. */
                         if (
                             s && length >= (LIBUS_RECV_BUFFER_LENGTH - 24 * 1024) && length <= LIBUS_RECV_BUFFER_LENGTH &&
-                            (error || loop->num_ready_polls < LOOP_ISNT_VERY_BUSY_THRESHOLD) &&
+                            loop->num_ready_polls < LOOP_ISNT_VERY_BUSY_THRESHOLD &&
                             !us_socket_is_closed(s) && !s->flags.is_paused
                         ) {
-                            repeat_recv_count += error == 0;
+                            repeat_recv_count++;
 
                             // When not hung up, read a maximum of 10 times to avoid starving other sockets
                             // We don't bother with ioctl(FIONREAD) because we've set MSG_DONTWAIT
@@ -672,6 +689,18 @@ void us_internal_dispatch_ready_poll(struct us_poll_t *p, int error, int eof, in
                         eof = 1; // lets handle EOF in the same place
                         break;
                     } else if (length == LIBUS_SOCKET_ERROR && !bsd_would_block()) {
+                        if (eof && read_any) {
+                            /* The hangup drain above already delivered this
+                             * connection's final data and then hit the error queued
+                             * behind its FIN (an RST from the peer tearing down right
+                             * after, often provoked by our own teardown writes). The
+                             * orderly EOF was announced and nothing readable remains:
+                             * report end-of-stream like a reader that stopped at the
+                             * FIN, not a read error. A hard error on the FIRST read of
+                             * a hung-up event (a pure RST: the kernel discards the
+                             * receive queue) still takes the error path below. */
+                            break;
+                        }
                         /* Peer-initiated TCP error (RST etc.) — go straight to
                          * raw-close. us_socket_close() would route through
                          * us_internal_ssl_close() now that s->ssl is the
@@ -690,6 +719,18 @@ void us_internal_dispatch_ready_poll(struct us_poll_t *p, int error, int eof, in
                 } while (s);
             }
 
+            /* kqueue reports EV_EOF on the same readable event as a connection's
+             * final data. If the data callback paused the socket mid-burst (stream
+             * backpressure), the read loop above stopped with bytes still queued in
+             * the kernel, and acting on the hint now would end+close the socket and
+             * discard them. Defer it: resuming re-arms the poll and the EOF is
+             * re-reported once the rest has been read. Sockets we already shut down
+             * are exempt (their peer's FIN must still close them promptly below),
+             * as are error-flagged events. */
+            if (eof && s && !error && s->flags.is_paused && !us_socket_is_shut_down(s) &&
+                !us_socket_is_closed(s)) {
+                eof = 0;
+            }
             if(eof && s) {
                 if (UNLIKELY(us_socket_is_closed(s))) {
                     // Do not call on_end after the socket has been closed

packages/bun-usockets/src/socket.c

@@ -500,10 +500,22 @@ int us_socket_write_check_error(struct us_socket_t *s, const char *data, int len
             us_poll_change(&s->p, s->group->loop, LIBUS_SOCKET_READABLE | LIBUS_SOCKET_WRITABLE);
             return 0;
         }
-        /* Fatal send error (EPIPE/ECONNRESET after the peer vanished): report
-         * it to callers that opt in instead of masking it as would-block, and
-         * do not keep polling writable - retrying can never succeed. */
-        if (fatal_write_error) *fatal_write_error = 1;
+#ifndef _WIN32
+        /* libuv treats ENOBUFS like EAGAIN and reports macOS's racy EPROTOTYPE
+         * as ECONNRESET (vendor/libuv/src/unix/stream.c uv__try_write). */
+        if (errno == ENOBUFS) {
+            s->flags.last_write_failed = 1;
+            us_poll_change(&s->p, s->group->loop, LIBUS_SOCKET_READABLE | LIBUS_SOCKET_WRITABLE);
+            return 0;
+        }
+#ifdef __APPLE__
+        if (errno == EPROTOTYPE) errno = ECONNRESET;
+#endif
+        /* Fatal send error: report the errno to callers that opt in and stop
+         * polling writable - retrying can never succeed. Windows leaves the
+         * out-param 0 until its WSA-to-errno translation is wired up. */
+        if (fatal_write_error) *fatal_write_error = errno;
+#endif
         return 0;
     }
     if (written != length) {

packages/bun-uws/src/App.h

@@ -757,6 +757,12 @@ struct TemplatedApp {
         httpContext->getSocketContextData()->onSocketUpgraded = onUpgraded;
     }
 
+    /* Marks this app as backing a node:http server, enabling the per-socket
+     * request timing used by headersTimeout/requestTimeout. */
+    void setUsingNodeHttpCompat(bool value) {
+        httpContext->getSocketContextData()->flags.usingNodeHttpCompat = value;
+    }
+
     TemplatedApp &&run() {
         uWS::run();
         return std::move(*this);
@@ -767,9 +773,10 @@ struct TemplatedApp {
         return std::move(*this);
     }
 
-    TemplatedApp &&setFlags(bool requireHostHeader, bool useStrictMethodValidation) {
+    TemplatedApp &&setFlags(bool requireHostHeader, bool useStrictMethodValidation, bool useInsecureHTTPParser) {
         httpContext->getSocketContextData()->flags.requireHostHeader = requireHostHeader;
         httpContext->getSocketContextData()->flags.useStrictMethodValidation = useStrictMethodValidation;
+        httpContext->getSocketContextData()->flags.useInsecureHTTPParser = useInsecureHTTPParser;
         return std::move(*this);
     }
 

packages/bun-uws/src/ChunkedEncoding.h

@@ -70,7 +70,11 @@ namespace uWS {
      *   chunk-ext-name = token
      *   chunk-ext-val  = token / quoted-string  (TODO: quoted-string unsupported)
      */
-    inline uint64_t consumeHexNumber(std::string_view &data, uint64_t state) {
+    /* chunkExtensionsConsumed (optional): incremented for every chunk-extension
+     * byte consumed; accumulates across every chunk-size line of the body so
+     * the caller can enforce llhttp's per-message extension limit (node:http
+     * compat). The caller resets it at the start of each new chunked body. */
+    inline uint64_t consumeHexNumber(std::string_view &data, uint64_t state, uint64_t *chunkExtensionsConsumed = nullptr) {
         /* Resume: '\r' was the last byte of the previous segment. Rare path,
          * use data directly to avoid the p/len load on the hot path. */
         if (state & STATE_WAITING_FOR_LF) [[unlikely]] {
@@ -127,6 +131,9 @@ namespace uWS {
             }
             if (c <= 32) return STATE_IS_ERROR;
             state |= STATE_IS_CHUNKED_EXTENSION;
+            if (chunkExtensionsConsumed) {
+                ++*chunkExtensionsConsumed;
+            }
         }
         data = std::string_view(p, len);
         return state; /* short read */
@@ -149,10 +156,72 @@ namespace uWS {
         return state == STATE_IS_ERROR;
     }
 
+    /* node:http compat: parser state for "consuming the trailer section after the
+     * final 0-size chunk" (RFC 9112 7.1.2). The flag combinations cannot occur in
+     * any other state: STATE_WAITING_FOR_LF is only ever set while the chunk-size
+     * line is incomplete, i.e. before STATE_HAS_SIZE is set. _DONE means the
+     * section (and thus the message) completed and the fin chunk was emitted; the
+     * next call resets the state without touching the remaining bytes. The
+     * sub-state must not be derived from the captured section's contents: the fin
+     * delivery can synchronously run JS that consumes (and clears) the capture. */
+    constexpr uint64_t STATE_IS_TRAILERS = STATE_HAS_SIZE | STATE_IS_CHUNKED | STATE_WAITING_FOR_LF;
+    constexpr uint64_t STATE_IS_TRAILERS_DONE = STATE_HAS_SIZE | STATE_WAITING_FOR_LF;
+
+    /* Default cap on the raw size of a captured trailer section. Node counts
+     * trailer bytes against the same max-header-size budget as request headers
+     * in llhttp, so node:http callers thread the per-server maxHeaderSize
+     * through; this constant is the fallback for callers that do not. */
+    constexpr uint64_t MAX_TRAILER_SECTION_SIZE = 16 * 1024;
+
+    /* The trailer section is complete once the empty line terminating it has been
+     * consumed: either the section is empty ("\r\n") or it ends with "\r\n\r\n". */
+    inline bool isCompleteTrailerSection(const std::string &section) {
+        size_t n = section.size();
+        if (n == 2) {
+            return section[0] == '\r' && section[1] == '\n';
+        }
+        return n >= 4 && memcmp(section.data() + n - 4, "\r\n\r\n", 4) == 0;
+    }
+
     /* Returns next chunk (empty or not), or if all data was consumed, nullopt is returned. */
-    static std::optional<std::string_view> getNextChunk(std::string_view &data, uint64_t &state, bool trailer = false) {
+    static std::optional<std::string_view> getNextChunk(std::string_view &data, uint64_t &state, bool trailer = false, uint64_t *chunkExtensionsConsumed = nullptr, std::string *trailerSection = nullptr, uint64_t maxTrailerSectionSize = MAX_TRAILER_SECTION_SIZE) {
+        /* node:http compat: the previous call emitted the fin chunk for a message
+         * whose trailer section completed; this call only resets the state and
+         * leaves the remaining bytes (the next request, or tunnel data) untouched. */
+        if (trailerSection && state == STATE_IS_TRAILERS_DONE) [[unlikely]] {
+            state = 0;
+            return std::nullopt;
+        }
         while (data.length()) {
 
+            /* node:http compat: consume the trailer section that follows the final
+             * 0-size chunk, capturing its raw bytes so the server can populate
+             * req.trailers. The terminating empty chunk (fin) is only emitted once
+             * the whole section (including its final CRLF) has been consumed, so
+             * trailers are always available by the time the message completes. */
+            if (trailerSection && state == STATE_IS_TRAILERS) [[unlikely]] {
+                /* A zero cap means the caller has no header-size limit configured (node's
+                 * maxHeaderSize: 0 selects the default, never "unlimited"): the captured
+                 * section must always be bounded or a never-terminating trailer stream OOMs. */
+                uint64_t trailerSectionCap = maxTrailerSectionSize ? maxTrailerSectionSize : MAX_TRAILER_SECTION_SIZE;
+                while (data.length()) {
+                    char c = data[0];
+                    trailerSection->push_back(c);
+                    data.remove_prefix(1);
+                    if (trailerSection->size() > trailerSectionCap) [[unlikely]] {
+                        state = STATE_IS_ERROR;
+                        return std::nullopt;
+                    }
+                    if (c == '\n' && isCompleteTrailerSection(*trailerSection)) {
+                        /* Message complete: emit the fin chunk. The next call sees
+                         * STATE_IS_TRAILERS_DONE and resets to 0. */
+                        state = STATE_IS_TRAILERS_DONE;
+                        return std::string_view(nullptr, 0);
+                    }
+                }
+                return std::nullopt;
+            }
+
             // if in "drop trailer mode", consume the terminator bytes after the
             // zero-chunk. This is 2 bytes (\r\n) with no trailer, or 4 bytes
             // (\r\n\r\n) with trailer=true. Upstream uWS consumed these bytes
@@ -184,14 +253,22 @@ namespace uWS {
             }
 
             if (!hasChunkSize(state)) {
-                state = consumeHexNumber(data, state);
+                state = consumeHexNumber(data, state, chunkExtensionsConsumed);
                 if (isParsingInvalidChunkedEncoding(state)) [[unlikely]] {
                     return std::nullopt;
                 }
                 if (hasChunkSize(state) && chunkSize(state) == 2) {
 
                     //printf("Setting state to trailer-parsing and emitting empty chunk\n");
 
+                    /* node:http compat: the message is not complete until the trailer
+                     * section has been consumed; capture it and emit the fin chunk
+                     * from the trailer-section branch above instead of here. */
+                    if (trailerSection) {
+                        state = STATE_IS_TRAILERS;
+                        continue;
+                    }
+
                     // set trailer state and increase size to 4
                     if (trailer) {
                         state = 4 /*| STATE_IS_CHUNKED*/ | STATE_HAS_SIZE;
@@ -306,12 +383,15 @@ namespace uWS {
         std::optional<std::string_view> chunk;
         uint64_t *state;
         bool trailer;
+        uint64_t *chunkExtensionsConsumed;
+        std::string *trailerSection;
+        uint64_t maxTrailerSectionSize;
 
-        ChunkIterator(std::string_view *data, uint64_t *state, bool trailer = false) : data(data), state(state), trailer(trailer) {
-            chunk = uWS::getNextChunk(*data, *state, trailer);
+        ChunkIterator(std::string_view *data, uint64_t *state, bool trailer = false, uint64_t *chunkExtensionsConsumed = nullptr, std::string *trailerSection = nullptr, uint64_t maxTrailerSectionSize = MAX_TRAILER_SECTION_SIZE) : data(data), state(state), trailer(trailer), chunkExtensionsConsumed(chunkExtensionsConsumed), trailerSection(trailerSection), maxTrailerSectionSize(maxTrailerSectionSize) {
+            chunk = uWS::getNextChunk(*data, *state, trailer, chunkExtensionsConsumed, trailerSection, maxTrailerSectionSize);
         }
 
-        ChunkIterator() {
+        ChunkIterator() : data(nullptr), state(nullptr), trailer(false), chunkExtensionsConsumed(nullptr), trailerSection(nullptr), maxTrailerSectionSize(MAX_TRAILER_SECTION_SIZE) {
 
         }
 
@@ -335,7 +415,7 @@ namespace uWS {
         }
 
         ChunkIterator &operator++() {
-            chunk = uWS::getNextChunk(*data, *state, trailer);
+            chunk = uWS::getNextChunk(*data, *state, trailer, chunkExtensionsConsumed, trailerSection, maxTrailerSectionSize);
             return *this;
         }