oven-sh · cirospaciari · Aug 4, 2026 · Jul 17, 2026 · Jul 17, 2026 · Jul 17, 2026
diff --git a/packages/bun-uws/src/App.h b/packages/bun-uws/src/App.h
@@ -772,10 +772,13 @@ struct TemplatedApp {
         return std::move(*this);
     }
 
-    TemplatedApp &&setFlags(bool requireHostHeader, bool useStrictMethodValidation, bool useInsecureHTTPParser, bool httpAllowHalfOpen) {
+    /* lenientHttpFlags: bit 0 = lenient header values (llhttp LENIENT_HEADERS),
+     * bit 1 = lenient transfer-encoding (llhttp LENIENT_TRANSFER_ENCODING). */
+    TemplatedApp &&setFlags(bool requireHostHeader, bool useStrictMethodValidation, uint8_t lenientHttpFlags, bool httpAllowHalfOpen) {
         httpContext->getSocketContextData()->flags.requireHostHeader = requireHostHeader;
         httpContext->getSocketContextData()->flags.useStrictMethodValidation = useStrictMethodValidation;
-        httpContext->getSocketContextData()->flags.useInsecureHTTPParser = useInsecureHTTPParser;
+        httpContext->getSocketContextData()->flags.useInsecureHTTPParser = (lenientHttpFlags & 1) != 0;
+        httpContext->getSocketContextData()->flags.useLenientTransferEncoding = (lenientHttpFlags & 2) != 0;
         httpContext->getSocketContextData()->flags.httpAllowHalfOpen = httpAllowHalfOpen;
         return std::move(*this);
     }

diff --git a/packages/bun-uws/src/HttpContext.h b/packages/bun-uws/src/HttpContext.h
@@ -38,6 +38,8 @@
 #include <mutex>
 
 
+extern "C" void Bun__NodeHTTP__onReadsResumable(int ssl, struct us_socket_t *s);
+
 namespace uWS {
 
 namespace detail {
@@ -130,6 +132,13 @@ struct HttpContext {
     static unsigned char socketKind() { return SSL ? US_SOCKET_KIND_UWS_HTTP_TLS : US_SOCKET_KIND_UWS_HTTP; }
 
 public:
+    /* node:http flood prevention: re-feed parked request bytes through the same
+     * parse path fresh socket data takes. The caller guarantees the buffer has
+     * LIBUS_RECV_BUFFER_PADDING of writable slack past `length`. */
+    static us_socket_t *feedNodeHttpData(us_socket_t *s, char *data, int length) {
+        return onData<true>(s, data, length);
+    }
+
     us_socket_group_t *getSocketGroup() {
         return &group;
     }
@@ -337,7 +346,7 @@ struct HttpContext {
             nodeHttpRequestTrailers = &nodeHttpResponseData->nodeHttpRequestTrailers;
         }
 
-        auto result = httpResponseData->template consumePostPadded<IsNodeHttp>(httpContextData->maxHeaderSize, httpResponseData->isConnectRequest, httpContextData->flags.requireHostHeader,httpContextData->flags.useStrictMethodValidation, httpContextData->flags.useInsecureHTTPParser, nodeHttpRequestTrailers, &httpResponseData->chunkedExtensionsByteCount, data, (unsigned int) length, s, proxyParser, [httpContextData](void *s, HttpRequest *httpRequest) -> void * {
+        auto result = httpResponseData->template consumePostPadded<IsNodeHttp>(httpContextData->maxHeaderSize, httpResponseData->isConnectRequest, httpContextData->flags.requireHostHeader,httpContextData->flags.useStrictMethodValidation, httpContextData->flags.useInsecureHTTPParser, httpContextData->flags.useLenientTransferEncoding, nodeHttpRequestTrailers, &httpResponseData->chunkedExtensionsByteCount, data, (unsigned int) length, s, proxyParser, [httpContextData](void *s, HttpRequest *httpRequest) -> void * {
 
 
             /* For every request we reset the timeout and hang until user makes action */
@@ -395,6 +404,9 @@ struct HttpContext {
                 httpResponseData->nodeHttpQueuedPipelinedCount++;
                 if (((AsyncSocket<SSL> *) s)->getBufferedAmount() > 0) {
                     httpResponseData->state |= HttpResponseData<SSL>::HTTP_NODE_READS_PAUSED;
+                    /* Also stop the request loop over the buffer being parsed
+                     * right now — pausing the socket alone cannot bound it. */
+                    httpResponseData->nodeHttpReadsPausedSignal = true;
                     ((HttpResponse<SSL> *) s)->pause();
                 }
                 }
@@ -421,6 +433,24 @@ struct HttpContext {
                  * on this keep-alive connection (the flag itself was cleared above). */
                 if constexpr (IsNodeHttp) {
                     ((HttpResponseData<SSL, true> *) httpResponseData)->nodeHttpResponseTrailers.clear();
+
+                    /* Node's flood prevention applies here too: a handler that
+                     * write()s and end()s synchronously completes each exchange
+                     * before the next dispatch, so the pipelined branch above
+                     * never runs — yet unflushed response bytes pile up on the
+                     * connection all the same. Once the socket carries outgoing
+                     * backpressure, stop reading (and stop consuming the
+                     * already-received requests: the signal parks them) until
+                     * onWritable drains it. This request still dispatches, like
+                     * Node, which pauses from within parserOnIncoming. No
+                     * already-paused guard: the replay clears the signal but not
+                     * the state bit, so gating on the bit would let the whole
+                     * spill dispatch unbounded on the first replay. */
+                    if (((AsyncSocket<SSL> *) s)->getBufferedAmount() > 0) {
+                        httpResponseData->state |= HttpResponseData<SSL>::HTTP_NODE_READS_PAUSED;
+                        httpResponseData->nodeHttpReadsPausedSignal = true;
+                        ((HttpResponse<SSL> *) s)->pause();
+                    }
                 }
             }
 
@@ -711,10 +741,12 @@ struct HttpContext {
          * backpressure when the queue drained; now that it has flushed, read
          * new requests again. */
         if constexpr (IsNodeHttp) {
-            if ((httpResponseData->state & HttpResponseData<SSL>::HTTP_NODE_READS_PAUSED) && httpResponseData->nodeHttpQueuedPipelinedCount == 0
-                && asyncSocket->getBufferedAmount() == 0) {
-                httpResponseData->state &= ~HttpResponseData<SSL>::HTTP_NODE_READS_PAUSED;
-                reinterpret_cast<HttpResponse<SSL> *>(s)->resume();
+            if (httpResponseData->state & HttpResponseData<SSL>::HTTP_NODE_READS_PAUSED) {
+                /* Parked pipelined requests must be replayed before the socket
+                 * reads fresh bytes, or the stream reorders; the hook holds
+                 * under outgoing backpressure and resumes raw reads only once
+                 * the queue and the spill drain (JSNodeHTTPServerSocket.cpp). */
+                Bun__NodeHTTP__onReadsResumable(SSL, s);
             }
         }
 

diff --git a/packages/bun-uws/src/HttpContextData.h b/packages/bun-uws/src/HttpContextData.h
@@ -34,12 +34,17 @@ struct HttpFlags {
     bool requireHostHeader: 1 = true;
     bool isAuthorized: 1 = false;
     bool useStrictMethodValidation: 1 = false;
-    /* node:http insecureHTTPParser server option. NOTE: unlike Node's server
-     * (which fans kLenientAll out to all 10 llhttp lenient setters), the uWS
-     * parser only implements the LENIENT_HEADERS bit (control bytes accepted
-     * in field values); TE+CL conflict, chunked-size/CRLF strictness, version
-     * and header-token checks are still enforced. */
+    /* node:http parser leniency. Two of llhttp's lenient bits are implemented:
+     * useInsecureHTTPParser is LENIENT_HEADERS (control bytes accepted in field
+     * values) — set for both httpValidation "relaxed" and "insecure" —
+     * and useLenientTransferEncoding is LENIENT_TRANSFER_ENCODING (a chunked
+     * coding with another value after it, e.g. a duplicate Transfer-Encoding:
+     * chunked header, is accepted) — set only for "insecure" /
+     * --insecure-http-parser, never for "relaxed", which must relax header
+     * values alone. The TE+CL conflict, chunked-size/CRLF strictness, version
+     * and header-token checks are still enforced under both. */
     bool useInsecureHTTPParser: 1 = false;
+    bool useLenientTransferEncoding: 1 = false;
     /* node:http server.httpAllowHalfOpen: when true, a peer FIN with in-flight
      * or queued responses keeps the connection open until they drain (Node's
      * socketOnEnd); when false (the default), the connection ends right away. */