$ the-wire · showcase
UNDICI PATCHES HTTP/2 SESSION COLLAPSE, NODE CORE HARDENS BUFFER ENCODING
By RepoJournal · Filed · About Node.js · Composed from the cited sources · methodology
3 people shipped this
Undici's HTTP/2 client now auto-recovers from invalid sessions instead of failing hard, while Node core plugs a race condition that could corrupt SharedArrayBuffer-backed buffers during encoding.
The undici team shipped a critical fix that resets cached HTTP/2 session state when `session.request()` throws `ERR_HTTP2_INVALID_SESSION`, then requeues the unsent request on a fresh connection [1]. This prevents cascading failures in production where a single bad session could take down an entire client. In parallel, they're landing a connector feature that lets you prefer HTTP/2 in ALPN negotiation via a new `preferH2` option [2], solving interop headaches with load balancers that follow client preference. Over in Node core, Antoine du Hamel closed a TOCTOU race condition in SAB-backed buffer encoding that could lead to memory corruption [3], a quiet but serious fix tracked on HackerOne. The core team also cleaned up unused util functions [4] and fixed duplicated build conditions around sqlite and ffi [5]. HTTP header validation is getting more flexible too: the `insecureHTTPParser` option now gates lenient control-character handling to match the Fetch spec, letting Node interop with non-compliant servers without going fully permissive [6]. On the documentation front, undici's HTTP/2 trailers test is being refactored to use async/await patterns and shared fixtures instead of callbacks, eliminating flakiness [7].
Action items
- → If you're running undici in production with HTTP/2, verify your error handling works with the session reset behavior [ref:1] nodejs/undici [plan]
- → Review SAB usage in your codebase if you're encoding SharedArrayBuffer-backed buffers; update Node when this ships [ref:9] nodejs/node [immediate]
- → Test your HTTP header parsing with the new validation rules if you rely on `insecureHTTPParser` [ref:12] nodejs/node [monitor]
References
- [1] fix: reset invalid HTTP/2 sessions ↗ nodejs/undici
- [2] feat(connect): add `preferH2` connector option to offer h2 first in ALPN ↗ nodejs/undici
- [3] src: remove TOCTOU race condition when encoding SAB-backed `Buffer`s ↗ nodejs/node
- [4] util: remove unused functions ↗ nodejs/node
- [5] build: remove duplicated node_use_sqlite and node_use_ffi conditions ↗ nodejs/node
- [6] http: align header value validation with Fetch spec ↗ nodejs/node
- [7] test: fix flaky http2 trailers test ↗ nodejs/undici
