http/http2: node v26.3.0 compat — HTTP/1 fallback + upgrade handoff, http2 session errors, perf_hooks and frame framing (+11 upstream tests)

packages/bun-uws/src/App.h

@@ -772,10 +772,13 @@ struct TemplatedApp {
         return std::move(*this);
     }
 
-    TemplatedApp &&setFlags(bool requireHostHeader, bool useStrictMethodValidation, bool useInsecureHTTPParser, bool httpAllowHalfOpen) {
+    /* lenientHttpFlags: bit 0 = lenient header values (llhttp LENIENT_HEADERS),
+     * bit 1 = lenient transfer-encoding (llhttp LENIENT_TRANSFER_ENCODING). */
+    TemplatedApp &&setFlags(bool requireHostHeader, bool useStrictMethodValidation, uint8_t lenientHttpFlags, bool httpAllowHalfOpen) {
         httpContext->getSocketContextData()->flags.requireHostHeader = requireHostHeader;
         httpContext->getSocketContextData()->flags.useStrictMethodValidation = useStrictMethodValidation;
-        httpContext->getSocketContextData()->flags.useInsecureHTTPParser = useInsecureHTTPParser;
+        httpContext->getSocketContextData()->flags.useInsecureHTTPParser = (lenientHttpFlags & 1) != 0;
+        httpContext->getSocketContextData()->flags.useLenientTransferEncoding = (lenientHttpFlags & 2) != 0;
         httpContext->getSocketContextData()->flags.httpAllowHalfOpen = httpAllowHalfOpen;
         return std::move(*this);
     }

packages/bun-uws/src/HttpContext.h

@@ -339,7 +339,7 @@ struct HttpContext {
             nodeHttpChunkedExtensionsByteCount = &nodeHttpResponseData->chunkedExtensionsByteCount;
         }
 
-        auto result = httpResponseData->template consumePostPadded<IsNodeHttp>(httpContextData->maxHeaderSize, httpResponseData->isConnectRequest, httpContextData->flags.requireHostHeader,httpContextData->flags.useStrictMethodValidation, httpContextData->flags.useInsecureHTTPParser, nodeHttpRequestTrailers, nodeHttpChunkedExtensionsByteCount, data, (unsigned int) length, s, proxyParser, [httpContextData](void *s, HttpRequest *httpRequest) -> void * {
+        auto result = httpResponseData->template consumePostPadded<IsNodeHttp>(httpContextData->maxHeaderSize, httpResponseData->isConnectRequest, httpContextData->flags.requireHostHeader,httpContextData->flags.useStrictMethodValidation, httpContextData->flags.useInsecureHTTPParser, httpContextData->flags.useLenientTransferEncoding, nodeHttpRequestTrailers, nodeHttpChunkedExtensionsByteCount, data, (unsigned int) length, s, proxyParser, [httpContextData](void *s, HttpRequest *httpRequest) -> void * {
 
 
             /* For every request we reset the timeout and hang until user makes action */

packages/bun-uws/src/HttpContextData.h

@@ -34,12 +34,17 @@ struct HttpFlags {
     bool requireHostHeader: 1 = true;
     bool isAuthorized: 1 = false;
     bool useStrictMethodValidation: 1 = false;
-    /* node:http insecureHTTPParser server option. NOTE: unlike Node's server
-     * (which fans kLenientAll out to all 10 llhttp lenient setters), the uWS
-     * parser only implements the LENIENT_HEADERS bit (control bytes accepted
-     * in field values); TE+CL conflict, chunked-size/CRLF strictness, version
-     * and header-token checks are still enforced. */
+    /* node:http parser leniency. Two of llhttp's lenient bits are implemented:
+     * useInsecureHTTPParser is LENIENT_HEADERS (control bytes accepted in field
+     * values) — set for both httpValidation "relaxed" and "insecure" —
+     * and useLenientTransferEncoding is LENIENT_TRANSFER_ENCODING (a chunked
+     * coding with another value after it, e.g. a duplicate Transfer-Encoding:
+     * chunked header, is accepted) — set only for "insecure" /
+     * --insecure-http-parser, never for "relaxed", which must relax header
+     * values alone. The TE+CL conflict, chunked-size/CRLF strictness, version
+     * and header-token checks are still enforced under both. */
     bool useInsecureHTTPParser: 1 = false;
+    bool useLenientTransferEncoding: 1 = false;
     /* node:http server.httpAllowHalfOpen: when true, a peer FIN with in-flight
      * or queued responses keeps the connection open until they drain (Node's
      * socketOnEnd); when false (the default), the connection ends right away. */

packages/bun-uws/src/HttpParser.h

@@ -572,6 +572,14 @@ struct HttpResponseData;
         bool nodeHttpSawConnectionClose = false;
 
         const size_t MAX_FALLBACK_SIZE = BUN_DEFAULT_MAX_HTTP_HEADER_SIZE;
+        /* maxHeaderSize bounds what llhttp counts — the URL plus each field name and
+         * value — but the raw block also carries framing llhttp never charges: the
+         * method and " HTTP/1.1\r\n", a ": " and "\r\n" per header, and the terminating
+         * "\r\n". Bounding raw bytes by maxHeaderSize itself would reject a request
+         * Node accepts, so the raw bounds get exactly that framing as slack. It stays
+         * finite: at most UWS_HTTP_MAX_HEADERS_COUNT headers contribute 4 bytes each,
+         * and a field value's raw span is already bounded by the in-loop check. */
+        static constexpr size_t MAX_HEADER_FRAMING_SLACK = UWS_HTTP_MAX_HEADERS_COUNT * 4 + 64;
 
         /* Maximum size of the chunk extensions of a single chunk, matching Node's
          * kMaxChunkExtensionsSize in src/node_http_parser.cc (16 KiB). Enforced
@@ -938,8 +946,18 @@ struct HttpResponseData;
             if(requestLineResult.isConnect) {
                 isConnectRequest = true;
             }
-            /* No request headers found */
-            const char * headerStart = (headers[0].key.length() > 0) ? headers[0].key.data() : end;
+            /* llhttp — and therefore Node — bounds the header block by the bytes it hands
+             * to its callbacks: on_url, then each field name and field value. It does not
+             * charge the method, " HTTP/1.1\r\n", the ": " separators or the "\r\n" line
+             * endings against that budget, so counting the raw offset into the buffer
+             * rejects requests Node accepts. Mirror llhttp's TrackHeader: accumulate
+             * name + value lengths and fail once the total reaches maxHeaderSize. The
+             * fallback buffer keeps its own bound (maxBufferedHeaderSize below), which is
+             * what caps how much raw data a fragmented request may buffer. */
+            uint64_t headerNread = headers[0].value.length();
+            if (maxHeaderSize && headerNread >= maxHeaderSize) {
+                return HttpParserResult::error(HTTP_ERROR_431_REQUEST_HEADER_FIELDS_TOO_LARGE, HTTP_PARSER_ERROR_REQUEST_HEADER_FIELDS_TOO_LARGE);
+            }
 
             /* Check if we can see if headers follow or not */
             if (postPaddedBuffer + 2 > end) {
@@ -961,7 +979,8 @@ struct HttpResponseData;
                 preliminaryKey = postPaddedBuffer;
                 postPaddedBuffer = consumeFieldName(postPaddedBuffer);
                 headers->key = std::string_view(preliminaryKey, (size_t) (postPaddedBuffer - preliminaryKey));
-                if(maxHeaderSize && (uintptr_t)(postPaddedBuffer - headerStart) > maxHeaderSize) {
+                headerNread += headers->key.length();
+                if(maxHeaderSize && headerNread >= maxHeaderSize) {
                     return HttpParserResult::error(HTTP_ERROR_431_REQUEST_HEADER_FIELDS_TOO_LARGE, HTTP_PARSER_ERROR_REQUEST_HEADER_FIELDS_TOO_LARGE);
                 }
                 /* We should not accept whitespace between key and colon, so colon must foloow immediately */
@@ -1004,7 +1023,16 @@ struct HttpResponseData;
                     }
                     break;
                 }
-                if(maxHeaderSize && (uintptr_t)(postPaddedBuffer - headerStart) > maxHeaderSize) {
+                /* Bound the value before its terminator is found — a value that never
+                 * terminates must still overflow here, exactly where llhttp would, or an
+                 * oversized unterminated header just waits for more data instead of
+                 * failing. llhttp is handed the value with leading OWS already skipped,
+                 * so that OWS is not charged. */
+                const char *countedValueStart = preliminaryValue;
+                while (countedValueStart < postPaddedBuffer && isHTTPHeaderValueWhitespace((unsigned char) *countedValueStart)) {
+                    countedValueStart++;
+                }
+                if(maxHeaderSize && headerNread + (uintptr_t)(postPaddedBuffer - countedValueStart) >= maxHeaderSize) {
                     return HttpParserResult::error(HTTP_ERROR_431_REQUEST_HEADER_FIELDS_TOO_LARGE, HTTP_PARSER_ERROR_REQUEST_HEADER_FIELDS_TOO_LARGE);
                 }
                 if (end - postPaddedBuffer < 2) {
@@ -1015,6 +1043,15 @@ struct HttpResponseData;
                 if (postPaddedBuffer[1] == '\n') {
                     /* Store this header, it is valid */
                     headers->value = std::string_view(preliminaryValue, (size_t) (postPaddedBuffer - preliminaryValue));
+                    /* Charge the value the way llhttp hands it to on_header_value: leading
+                     * OWS skipped, trailing OWS still counted. Measure before the trims
+                     * below, or a value padded with trailing spaces is undercharged and we
+                     * accept a header block Node answers with 431. */
+                    const char *chargedValueStart = preliminaryValue;
+                    while (chargedValueStart < postPaddedBuffer && isHTTPHeaderValueWhitespace((unsigned char) *chargedValueStart)) {
+                        chargedValueStart++;
+                    }
+                    const size_t chargedValueLength = (size_t) (postPaddedBuffer - chargedValueStart);
                     postPaddedBuffer += 2;
                     /* Trim trailing whitespace (SP, HTAB) per RFC 9110 Section 5.5 */
                     while (headers->value.length() && isHTTPHeaderValueWhitespace(headers->value.back())) {
@@ -1026,7 +1063,8 @@ struct HttpResponseData;
                         headers->value.remove_prefix(1);
                     }
 
-                    if(maxHeaderSize && (uintptr_t)(postPaddedBuffer - headerStart) > maxHeaderSize) {
+                    headerNread += chargedValueLength;
+                    if(maxHeaderSize && headerNread >= maxHeaderSize) {
                         return HttpParserResult::error(HTTP_ERROR_431_REQUEST_HEADER_FIELDS_TOO_LARGE, HTTP_PARSER_ERROR_REQUEST_HEADER_FIELDS_TOO_LARGE);
                     }
                     headers++;
@@ -1062,7 +1100,7 @@ struct HttpResponseData;
 
     /* This is the only caller of getHeaders and is thus the deepest part of the parser. */
     template <bool ConsumeMinimally, bool IsNodeHttp>
-    HttpParserResult fenceAndConsumePostPadded(uint64_t maxHeaderSize, bool& isConnectRequest, bool requireHostHeader, bool useStrictMethodValidation, bool useInsecureHTTPParser, std::string *nodeHttpRequestTrailers, uint64_t *chunkedExtensionsByteCount, char *data, unsigned int length, void *user, void *reserved, HttpRequest *req, MoveOnlyFunction<void *(void *, HttpRequest *)> &requestHandler, MoveOnlyFunction<void *(void *, std::string_view, bool)> &dataHandler) {
+    HttpParserResult fenceAndConsumePostPadded(uint64_t maxHeaderSize, bool& isConnectRequest, bool requireHostHeader, bool useStrictMethodValidation, bool useInsecureHTTPParser, bool useLenientTransferEncoding, std::string *nodeHttpRequestTrailers, uint64_t *chunkedExtensionsByteCount, char *data, unsigned int length, void *user, void *reserved, HttpRequest *req, MoveOnlyFunction<void *(void *, HttpRequest *)> &requestHandler, MoveOnlyFunction<void *(void *, std::string_view, bool)> &dataHandler) {
 
         /* How much data we CONSUMED (to throw away) */
         unsigned int consumedTotal = 0;
@@ -1118,7 +1156,7 @@ struct HttpResponseData;
             consumedTotal += consumed;
 
             /* Even if we could parse it, check for length here as well */
-            const uint64_t maxBufferedHeaderSize = maxHeaderSize ? maxHeaderSize : MAX_FALLBACK_SIZE;
+            const uint64_t maxBufferedHeaderSize = maxHeaderSize ? (maxHeaderSize + MAX_HEADER_FRAMING_SLACK) : MAX_FALLBACK_SIZE;
             if (consumed > maxBufferedHeaderSize) {
                 return HttpParserResult::error(HTTP_ERROR_431_REQUEST_HEADER_FIELDS_TOO_LARGE, HTTP_PARSER_ERROR_REQUEST_HEADER_FIELDS_TOO_LARGE);
             }
@@ -1180,6 +1218,16 @@ struct HttpResponseData;
             bool deferredTransferEncodingError = IsNodeHttp && transferEncoding.has
                 && !transferEncoding.invalid && !transferEncoding.chunked && !contentLengthStringLen;
 
+            /* llhttp's LENIENT_TRANSFER_ENCODING (part of Node's kLenientAll — the
+             * insecureHTTPParser / httpValidation: "insecure" surface, never
+             * "relaxed") accepts a chunked coding with another value after it,
+             * e.g. a duplicate Transfer-Encoding: chunked header. It does not
+             * relax the Transfer-Encoding + Content-Length conflict, so only the
+             * coding-shape verdict is cleared; the conflicts folded in below
+             * still reject. */
+            if (useLenientTransferEncoding) {
+                transferEncoding.invalid = false;
+            }
             transferEncoding.invalid = transferEncoding.invalid || (transferEncoding.has && (contentLengthStringLen || !transferEncoding.chunked));
 
             if (transferEncoding.invalid && !deferredTransferEncodingError) [[unlikely]] {
@@ -1337,10 +1385,10 @@ struct HttpResponseData;
 
 public:
     template <bool IsNodeHttp>
-    HttpParserResult consumePostPadded(uint64_t maxHeaderSize, bool& isConnectRequest, bool requireHostHeader, bool useStrictMethodValidation, bool useInsecureHTTPParser, std::string *nodeHttpRequestTrailers, uint64_t *chunkedExtensionsByteCount, char *data, unsigned int length, void *user, void *reserved, MoveOnlyFunction<void *(void *, HttpRequest *)> &&requestHandler, MoveOnlyFunction<void *(void *, std::string_view, bool)> &&dataHandler) {
+    HttpParserResult consumePostPadded(uint64_t maxHeaderSize, bool& isConnectRequest, bool requireHostHeader, bool useStrictMethodValidation, bool useInsecureHTTPParser, bool useLenientTransferEncoding, std::string *nodeHttpRequestTrailers, uint64_t *chunkedExtensionsByteCount, char *data, unsigned int length, void *user, void *reserved, MoveOnlyFunction<void *(void *, HttpRequest *)> &&requestHandler, MoveOnlyFunction<void *(void *, std::string_view, bool)> &&dataHandler) {
         /* The fallback buffer may not exceed the configured per-request header
          * limit (per-server maxHeaderSize can raise it above the default). */
-        const size_t maxFallbackSize = maxHeaderSize ? (size_t) maxHeaderSize : MAX_FALLBACK_SIZE;
+        const size_t maxFallbackSize = maxHeaderSize ? (size_t) (maxHeaderSize + MAX_HEADER_FRAMING_SLACK) : MAX_FALLBACK_SIZE;
         /* This resets BloomFilter by construction, but later we also reset it again.
         * Optimize this to skip resetting twice (req could be made global) */
         HttpRequest req;
@@ -1411,7 +1459,7 @@ struct HttpResponseData;
             fallback.append(data, maxCopyDistance);
 
             // break here on break
-            HttpParserResult consumed = fenceAndConsumePostPadded<true, IsNodeHttp>(maxHeaderSize, isConnectRequest, requireHostHeader, useStrictMethodValidation, useInsecureHTTPParser, nodeHttpRequestTrailers, chunkedExtensionsByteCount, fallback.data(), (unsigned int) fallback.length(), user, reserved, &req, requestHandler, dataHandler);
+            HttpParserResult consumed = fenceAndConsumePostPadded<true, IsNodeHttp>(maxHeaderSize, isConnectRequest, requireHostHeader, useStrictMethodValidation, useInsecureHTTPParser, useLenientTransferEncoding, nodeHttpRequestTrailers, chunkedExtensionsByteCount, fallback.data(), (unsigned int) fallback.length(), user, reserved, &req, requestHandler, dataHandler);
             /* Return data will be different than user if we are upgraded to WebSocket or have an error */
             if (consumed.returnedData != user) {
                 return consumed;
@@ -1491,7 +1539,7 @@ struct HttpResponseData;
             }
         }
 
-        HttpParserResult consumed = fenceAndConsumePostPadded<false, IsNodeHttp>(maxHeaderSize, isConnectRequest, requireHostHeader, useStrictMethodValidation, useInsecureHTTPParser, nodeHttpRequestTrailers, chunkedExtensionsByteCount, data, length, user, reserved, &req, requestHandler, dataHandler);
+        HttpParserResult consumed = fenceAndConsumePostPadded<false, IsNodeHttp>(maxHeaderSize, isConnectRequest, requireHostHeader, useStrictMethodValidation, useInsecureHTTPParser, useLenientTransferEncoding, nodeHttpRequestTrailers, chunkedExtensionsByteCount, data, length, user, reserved, &req, requestHandler, dataHandler);
         /* Return data will be different than user if we are upgraded to WebSocket or have an error */
         if (consumed.returnedData != user) {
             return consumed;

src/http/lib.rs

@@ -267,6 +267,23 @@ pub fn set_max_http_header_size(v: usize) {
     MAX_HTTP_HEADER_SIZE.store(v, Ordering::Relaxed);
 }
 
+/// `--insecure-http-parser`: the process-wide default for node:http's
+/// `insecureHTTPParser` option. Set once during single-threaded CLI parsing;
+/// read from JS when node:http builds its parser leniency flags.
+static INSECURE_HTTP_PARSER: AtomicBool = AtomicBool::new(false);
+
+/// Safe accessor for `INSECURE_HTTP_PARSER`.
+#[inline]
+pub fn insecure_http_parser() -> bool {
+    INSECURE_HTTP_PARSER.load(Ordering::Relaxed)
+}
+
+/// Safe setter for `INSECURE_HTTP_PARSER` (see [`insecure_http_parser`]).
+#[inline]
+pub fn set_insecure_http_parser(v: bool) {
+    INSECURE_HTTP_PARSER.store(v, Ordering::Relaxed);
+}
+
 /// Set once during single-threaded CLI parsing; read from the HTTP thread.
 pub static OVERRIDDEN_DEFAULT_USER_AGENT: std::sync::OnceLock<&'static [u8]> =
     std::sync::OnceLock::new();

src/js/internal/cluster/child.ts

@@ -216,7 +216,7 @@
 
   if (accepted && server[owner_symbol]) {
     const self = server[owner_symbol];
-    if (self.maxConnections != null && self._connections >= self.maxConnections) {
+    if (self.maxConnections != null && self._connections >= self.maxConnections && !self.dropMaxConnection) {
       accepted = false;
     }
   }

src/js/internal/http.ts

@@ -25,7 +25,7 @@ const {
     server: any,
     requireHostHeader: boolean,
     useStrictMethodValidation: boolean,
-    insecureHTTPParser: boolean,
+    lenientHttpFlags: number,
     maxHeaderSize: number,
     onClientError: (ssl: boolean, socket: any, errorCode: number, rawPacket: ArrayBuffer) => undefined,
     onConnection?: (socketHandle: any) => undefined,
@@ -34,7 +34,7 @@ const {
     server: any,
     requireHostHeader: boolean,
     useStrictMethodValidation: boolean,
-    insecureHTTPParser: boolean,
+    lenientHttpFlags: number,
     httpAllowHalfOpen: boolean,
   ) => void;
   getCompleteWebRequestOrResponseBodyValueAsArrayBuffer: (arg: any) => ArrayBuffer | undefined;