Skip to content

http2: fix a error in the check for frame->hd.type (related to CVE-2025-23085) #57644

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Apr 9, 2025
+4 −4
Merged

http2: fix a error in the check for frame->hd.type (related to CVE-2025-23085) #57644

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2d3a1fd
http2: fix an error in an if condition in 1b693fa
hgqxjj Mar 27, 2025
cf86853
http2:correct http2 header frame content
hgqxjj Apr 1, 2025
2279ad5
http2: correct comments
hgqxjj Apr 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/node_http2.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1206,7 +1206,7 @@ int Http2Session::OnFrameNotSent(nghttp2_session* handle,
// closed but the Http2Session will still be up causing a memory leak.
// Therefore, if the GOAWAY frame couldn't be send due to
// ERR_SESSION_CLOSING we should force close from our side.
if (frame->hd.type != 0x03) {
if (frame->hd.type != NGHTTP2_GOAWAY) {
return 0;
}
}
Expand Down
6 changes: 3 additions & 3 deletions test/parallel/test-http2-premature-close.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,9 +29,9 @@ async function requestAndClose(server) {
// Send a valid HEADERS frame
const headersFrame = Buffer.concat([
Buffer.from([
0x00, 0x00, 0x0c, // Length: 12 bytes
0x00, 0x00, 0x0e, // Length: 14 bytes
0x01, // Type: HEADERS
0x05, // Flags: END_HEADERS + END_STREAM
0x04, // Flags: END_HEADERS
(streamId >> 24) & 0xFF, // Stream ID: high byte
(streamId >> 16) & 0xFF,
(streamId >> 8) & 0xFF,
Expand All @@ -41,7 +41,7 @@ async function requestAndClose(server) {
0x82, // Indexed Header Field Representation (Predefined ":method: GET")
0x84, // Indexed Header Field Representation (Predefined ":path: /")
0x86, // Indexed Header Field Representation (Predefined ":scheme: http")
0x44, 0x0a, // Custom ":authority: localhost"
0x41, 0x09, // ":authority: localhost" Length: 9 bytes
0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74,
]),
]);
Expand Down
Loading