Khafradev

The EventSource client in this Node.js HTTP client library can be forced to exhaust process memory by a malicious Server-Sent Events peer. This occurs when a peer sends millions of small completed data fields without blank event separators, or a single unfinished line split across numerous chunks. The parser accumulates per-field and per-chunk state that is not restricted by `maxEventSize` or `maxResponseSize` limits. Additionally, because `maxResponseSize` is applied to the compressed body before decompression, a small compressed response can expand into a volume of retained memory sufficient to terminate the process. This affects applications maintaining an EventSource connection to an untrusted peer and impacts system availability.

The `fetch()` implementation in this Node.js HTTP client library incorrectly verifies Subresource Integrity (SRI) metadata. The library matches the algorithm token against a lowercase-only set, causing valid uppercase or mixed-case tokens (such as SHA256) to be treated as unknown and skipped. If no recognized algorithms remain, the integrity list is treated as empty and the response is accepted regardless of whether the body matches the pinned digest. This allows an attacker who controls the response body to deliver malicious bytes to an application using non-lowercase SRI tokens without triggering an integrity error.

When parsing a Set-Cookie header, the software accepts any SameSite attribute value containing Strict, Lax, or None as a substring instead of requiring a case-insensitive exact match as specified by RFC 6265. This allows non-spec values to be silently mapped to standard tokens; for instance, SameSite=NoneOfYourBusiness is parsed as None, and SameSite=StrictLax is parsed as Lax. Applications that consume Set-Cookie headers via fetch or proxy code paths and rely on the parsed `sameSite` attribute can be coerced by a malicious or non-compliant server into applying a weaker SameSite policy, degrading the intended cookie enforcement.

The cookie parser in the `parseSetCookie` function percent-decodes cookie values using `qsUnescape`, which converts encoded sequences such as %0D%0A, %00, %3B, and %3D into literal byte equivalents. This behavior deviates from RFC 6265 §5.4 and browser standards, which do not specify such decoding. Applications that use `parseSetCookie`, `parseCookie`, or `getSetCookies` and subsequently forward these parsed values into response headers (such as proxies, middleware, or SSR frameworks) are susceptible to HTTP response header injection. This allows an attacker-controlled upstream source to inject arbitrary Set-Cookie, Location, or Cache-Control headers into the downstream response, potentially leading to session fixation, open redirect, or cache poisoning.