Skip to content

fetch: accept HTTP/1.1 responses with more than 256 header fields - #34923

Open
robobun wants to merge 3 commits into
mainfrom
claude/farm/26801824/fetch-response-header-count-cap
Open

fetch: accept HTTP/1.1 responses with more than 256 header fields#34923
robobun wants to merge 3 commits into
mainfrom
claude/farm/26801824/fetch-response-header-count-cap

fetch: accept HTTP/1.1 responses with more than 256 header fields

6e2b024
Select commit
Loading
Failed to load commit list.
Claude / Claude Code Review completed Jul 21, 2026 in 20m 33s

Code review found 2 potential issues

Found 3 candidates, confirmed 2. See review comments for details.

Details

Severity Count
🔴 Important 0
🟡 Nit 2
🟣 Pre-existing 0
Severity File:Line Issue
🟡 Nit src/http/lib.rs:3759-3766 Stale SAFETY comment on detach_lifetime() omits new overflow Vec backing store
🟡 Nit src/http/lib.rs:3759-3761 Overflow Vec sized to full-buffer newline count; retained at high-water mark

Annotations

Check warning on line 3766 in src/http/lib.rs

See this annotation in the file changed.

@claude claude / Claude Code Review

Stale SAFETY comment on detach_lifetime() omits new overflow Vec backing store

The `SAFETY` comment at [src/http/lib.rs:3801-3802](https://github.com/oven-sh/bun/blob/6e2b024886d9f89177e0100e16d7e68f4b5d03c3/src/http/lib.rs#L3801-L3802) for `unsafe { response.detach_lifetime() }` still says `response` borrows only `SHARED_RESPONSE_HEADERS_BUF / response_message_buffer`. On the new overflow path, `response.headers.list` instead borrows `SHARED_RESPONSE_HEADERS_OVERFLOW`'s heap buffer — whose element storage moves on the next `resize()`, so the "outlive this fn" phrasing no 

Check warning on line 3761 in src/http/lib.rs

See this annotation in the file changed.

@claude claude / Claude Code Review

Overflow Vec sized to full-buffer newline count; retained at high-water mark

The overflow Vec is sized to `count_char(to_read!(), b'\n')`, but `to_read!()` at this point is the whole receive buffer — including any body bytes that arrived in the same read — so a >256-field response followed by a newline-dense body in the same packet(s) can size the Vec far beyond the actual header count (each `picohttp::Header` slot is 32 bytes, and a ~1 MB buffer of mostly-`\n` bytes maps to ~10-16 MB of slots). `SHARED_RESPONSE_HEADERS_OVERFLOW` is a process-lifetime static that is only