Skip to content

http: consolidate the open fetch, Bun.serve, node:http, node:http2 and HTTP/3 pull requests - #46528

Open
Jarred-Sumner wants to merge 35 commits into
mainfrom
claude/http-consolidated
Open

http: consolidate the open fetch, Bun.serve, node:http, node:http2 and HTTP/3 pull requests#46528
Jarred-Sumner wants to merge 35 commits into
mainfrom
claude/http-consolidated

Conversation

@Jarred-Sumner

@Jarred-Sumner Jarred-Sumner commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

What does this PR do?

In progress. The lists below describe the branch as it is now. A few more fixes from the final round of verification are still coming, so a number in this description can lag a push behind. CI still has failing tests on the Windows and sanitizer lanes, and they're being fixed.

Consolidates the open pull requests for fetch, Request / Response / Headers, Bun.serve, node:http, node:http2, HTTP/3, node:quic and the undici / node-fetch shims into one.

This branch is built on top of #46522 (node:net, node:tls, usockets) and contains its commits, so #46522 should be merged first. Until then the diff here shows both. Everything below is about this PR's own changes.

All 639 open PRs in that area were checked against Bun 1.4.4, which was main when the work started. For node:* behavior the same script ran on Node 26.12.1 first, and Node's answer decided. 145 PRs are included in part, 48 were already fixed, 15 are duplicates, 114 were skipped and 89 are left for a maintainer to decide. All the others are included whole, usually rewritten smaller.

After the ports, a second pass over the branch gave each rule one owner. A check that two layers made is now made once, in the layer that owns the data, and code that nothing calls any more is deleted with its tests. So this PR's own diff removes more than it adds: +21,450 -30,166 lines under src/ and packages/, a net 8,716 fewer. In the diff, req.socket is a plain net.Socket / tls.TLSSocket. node:http has one implementation per kind of connection (uWS for listen(), a port of Node's own connection code for every other stream) and one queue of waiting responses. node:http2 has one stream table and shares its wire types with fetch's HTTP/2 client, fetch has one table of in-flight requests, and Bun.serve, fetch and node:quic share one QUIC transport layer. Facts about a body (it was a string, fetch() decoded it, its type) travel with the body.

The body is at GitHub's size limit, so two lists are in the first two comments below: every behavior change with its 1.4.4 behavior next to it, and the PRs that are not included.

Read these first

These are the changes most likely to be noticed by a program that works today.

Bun.serve

fetch, Request, Response

node:http

node:http2

HTTP/3 and node:quic

undici and node-fetch

Where this PR still differs from Node on purpose, because 1.4.4 programs rely on it or because Bun's answer is the safer one:

  • node:http: a socket nobody reads closes when its connection is gone, server.unref() also lets go of sockets that 'upgrade' or 'connect' got, and req.socket.remoteAddress = x sticks.
  • node:http: a connection that closes under an ended response's last write still emits 'finish'. On listen() connections res.cork() has no effect and the head is always Latin-1.
  • node:http: a connection that reported a parse error is closed about 10 s later, even if the 'clientError' listener leaves it open. A body under a non-chunked Transfer-Encoding is sent with Connection: close.
  • node:http2: without an 'error' listener, a late write() on a response that respond() ended is dropped, a pushed stream's error isn't thrown, and an early NO_ERROR reset drops later writes. A client session with no 'stream' listener cancels pushes.

Fixes

node:quic

HTTP/3

node:http2

undici and node-fetch shims

node:http and node:https

Bun.serve

fetch, Request, Response, Headers

Other

Tests, docs and types

Deflakes, faster test files, new coverage, docs and type fixes: #24276, #31354, #32755, #33787, #34833, #35419, #35424, #35744, #35921, #35929, #36153, #36154, #36207, #36376, #36444, #36890, #36945, #36946, #37209, #37433, #37439, #37475, #37806, #37809, #37818, #37832, #37910, #37913, #37935, #38470, #38490, #39042, #39068, #39903, #39948, #39950, #39951, #40083, #40088, #40090, #40197, #40297, #40451, #40453, #40539, #40890, #41111, #41336, #41427, #41919, #41951, #42156, #42206, #42255, #42985, #43627, #44069, #44076, #44080, #44113, #44203, #44256, #44308, #44423, #44427, #44927, #44978, #44979, #45428, #45773, #45953, #46027.

How did you verify your code works?

  • Each fix has a test that fails on 1.4.4 and passes on the branch. Bugs only a sanitizer sees were checked against a debug + ASAN build of main. A few tests can't fail on Linux (macOS and Windows fixes), and a few pass on both builds because they guard what the second pass could have broken.
  • Not done yet: CI isn't green on the final state yet: every static check passes, and the Windows and sanitizer lanes still have failing tests. There's no release benchmark of the final state. The source lints, tsc on the three projects and the check of the published types against the schemas pass.
  • For node:* changes, the same script prints the same on Node 26.12.1 and on the branch, apart from the differences listed in the behavior changes. The shims were compared with undici 6.29.0 / 7.30.0 and node-fetch 2 / 3 under Node in the same way. The Node build used has no node:quic, so Node's answers there come from its source and from the original PRs' runs.
  • Test files, compared by test name on debug + ASAN builds. Before the second pass, about 1,400 files against main. During it, each group of changes against the build before it: the plain req.socket 236 files (227 pass, and the other 9 also fail on main or need Docker, the internet or a non-root user), node:http responses 108 files (6,261 tests pass, 3 failed: one is fixed since, one belongs to #46522, one needs a non-root user), Bun.serve 106 files (4,845 pass, 1 needs a non-root user), bodies 121 files (7,553 pass, 2 fail: that one, and a 10 s limit on a loaded machine), fetch and the shims 112 files (6,897 tests, 2 failed and are fixed), node:http2 13 files (1,232 pass).
  • Node's own tests during the second pass: 465 of 467 test-http-* and test-https-* files (the other 2 fail on main too), 257 of 259 http2 files (the other 2 pass when run separately), 305 of 311 test-quic-* and test-dgram-* files (6 failed before it too, 5 of them the same).
  • HTTP client: 2,406 scripted rows differ in 3 from the build before the pass (one connection saved, two races). 1,200 random response streams: no outcome differs. 1,650 random redirect chains: none differs from that build or from Node. Of 90 shapes of Location, 83 equal Node and 7 are as on 1.4.4.
  • Request parsing: the old and the new parser in one ASAN + UBSAN binary, 6,000 request streams split at every byte offset, 1.74 million runs: no difference. 8,000 trailer sections against an independent strict parser, 896,000 runs: no mismatch.
  • Tables: 1,116 raw requests to Bun.serve (header order, letter case and the Content-Encoding change differ, plus 2 rows by timing), 2,870 rows of Bun.serve options (only an internal key differs), 44 failed listens (all 22 node:* rows equal Node, none did on 1.4.4), 1,440 rows of node:http response bytes (450 changed, all to Node's), 798 TLSSocket members of an https req.socket (all equal a tls.Server socket's), 308 proxy shapes (78 lose a false Content-Encoding, none a true one), 7,104 node:http2 teardown cases (2 differ, listed under #43433), 35 ways to end a server under LeakSanitizer (no leak).
  • Random programs: before the second pass, 8,830 programs (24,228 runs on 1.4.4, Node and the branch) found six unintended differences, all fixed. During it, each group reran the families it touches, 240 to 1,300 programs each: no crash, sanitizer report or new hang. What they found is fixed, for example a graceful stop() that waited 16 s for a client.
  • The 1,077 identifiers the pass had deleted when #46522 was merged in were searched for in every tracked file, the exported ones also in the prebuilt WebKit and the vendored libraries. One deletion broke the link and was repaired.
  • Syscalls (strace): a node:http connection costs the same 8 calls as before the pass, and 800 Bun.serve keep-alive requests the same sendto, recvfrom and epoll_pwait2 counts.
  • Speed, on CI's release builds from before the second pass, with main against a copy of itself as the noise control (typically 1 to 3 %). Bun.serve over HTTP/1.1 and node:http hello world were within noise. fetch keep-alive (plain, TLS, and with Keep-Alive: timeout=5) was within 0.7 % of main in cycles per request, with 2 to 4 % fewer user instructions. Slower: a node:http2 server with 100 streams (1 to 2.5 % more cycles) and a node:http2 client downloading 1 MB bodies (4 to 5 %). require("node:http") took 1 % longer and the binary grew by 418 KB.
  • Speed during the pass. On CI's profile build with about a third of the node:http2 work: a server's 300,000 GETs take 4.0 % fewer user instructions than main (it was 3.7 % more), and a client's 1 GB download 0.3 % more cycles (it was 5.0 %). uWS by itself, compiled with release-like flags on stubbed sockets, in instructions per request: hello world 3,537 to 2,901, 16 headers 8,959 to 4,912, a static route 3,996 to 3,134, a file 3,875 to 2,786.
  • A known cost, not measured on a release build: a node:http response that has to wait for its turn (a pipelined request with an async handler) takes about twice the instructions. Without pipelining, or with a synchronous answer, it's the same or cheaper.
  • Same results before and after the pass: http-proxy, socket.io, supertest, koa, got, svelte, vite 6.2's dev server with HMR, hono, express, body-parser, @fastify/websocket. elysia, grpc-js and http2-wrapper fail what they failed before it, plus one elysia test that sleeps 3 ms. Before the pass, fastify, ws, axios, superagent and miniflare matched 1.4.4 too.
  • Windows, macOS and FreeBSD code is compiled and run by CI only: the half-close under kqueue, a socket's hand-off on libuv, the QUIC timer and the send loop without sendmmsg, the named pipe's listen error, and #46434's collection on Windows, whose test is skipped there. The HTTP/3 stream reset has no test here, because no lsquic peer can send that stream. It was checked against another QUIC implementation.

@Jarred-Sumner
Jarred-Sumner requested a review from alii as a code owner October 22, 2026 15:47
@Jarred-Sumner

Jarred-Sumner commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

All behavior changes, part 1: Bun.serve, fetch and the shims

Programs that ran without an error on 1.4.4 and behave differently now. Part 2 (node:http, node:http2, HTTP/3, node:quic) is in the next comment.

undici and node-fetch shims

  • 1.4.4 -> now. pool.request() / client.request(): returned undefined -> a promise (or calls the callback). agent.close() / destroy(): TypeError, not a function -> resolve null. new Pool() / new Client() without a valid http(s) origin: constructed -> throw InvalidArgumentError like undici. stream(): threw 'not yet implemented' -> works. request(): a response that fetch decoded no longer reports content-encoding and content-length; trailers is {} instead of undefined; a UrlObject works instead of throwing 'not implemented'; a signal that isn't an AbortSignal is accepted if it's an EventEmitter or EventTarget, else InvalidArgumentError instead of Error; a header whose value is undefined is skipped; a URL object passed with query is no longer modified. getGlobalDispatcher() returns an Agent. new Agent({ connect }) validates the TLS options in connect when it's constructed. request(url, { headers }) still takes an array of [name, value] pairs, as on 1.4.4, next to undici's flat array. (feat(undici): implement Pool, Client, Agent, and stream() #27338, in part)
  • 1.4.4 ignored ProxyAgent and sent requests directly. Now they go through the proxy, and fail if the proxy is down. new ProxyAgent() without a uri, or with both auth and token, throws InvalidArgumentError like undici (1.4.4 constructed a no-op). fetch(url, { dispatcher: new Agent({ connect: { rejectUnauthorized: false } }) }) now really skips verification, and ca / cert / key / servername apply (1.4.4 ignored them). undici.fetch is a thin wrapper and no longer === Bun.fetch. An explicit proxy / tls / unix in the fetch() init still wins over the dispatcher's. With an https: proxy, requestTls and proxyTls are both ignored and both hops are verified against the default trust store, so an https proxy or a target with a private CA rejects with a certificate error (1.4.4 ignored the ProxyAgent and connected directly). With an http: proxy requestTls applies to the target. (undici: wire ProxyAgent/setGlobalDispatcher/{dispatcher} to native fetch proxy #35145, in part)
  • 1.4.4 ignored a dispatcher's dispatch(). A dispatcher with its own dispatch() (a subclass of Dispatcher, or of Agent / Pool / Client that overrides it), passed as dispatcher or set with setGlobalDispatcher(), now receives every undici.fetch() / request() / stream() call. The Response of such a fetch() is built in JS: redirected is always false, url is the request URL, and Bun's own init options (proxy, tls, unix, verbose, decompress) aren't forwarded. Dispatchers without an override keep the native path. A BalancedPool or a bare new Dispatcher() as the dispatcher is still ignored, as on 1.4.4. (undici: implement dispatch(), close() and destroy() on the shim dispatchers #39250, in part)
  • 1.4.4: every undici error had name "Error", no code and an empty default message. (fix(node): preserve undici timeout error metadata #42716)
  • 1.4.4 returned "error" for every non-2xx node-fetch Response, now "default" like node-fetch 2 and 3. (node-fetch: report Response.type as default for an HTTP error status #43966)
  • 1.4.4: new FetchError().name was "Error" and it always had an own code. Now "FetchError", and code only with a system error. (node-fetch: name FetchError and AbortError like node-fetch #43967, in part)
  • 1.4.4 returned a plain web Response from these three statics (body was a web ReadableStream), now a node-fetch Response (body is a node Readable). (node-fetch: return a node-fetch Response from Response.json(), redirect() and error() #43968)
  • 1.4.4 rejected node-fetch's fetch() with the native TypeError (message "ECONNREFUSED: Unable to connect..."). Now a FetchError that is not a TypeError, message "request to failed, reason: ", errno is the code string, no path. err.code is unchanged. A default abort rejects with a new AbortError (still a DOMException named AbortError) instead of signal.reason itself. Native fetch(): a refused connection's error has a new syscall: "connect" property, which shows up when the error is printed. (node-fetch: reject fetch() and body reads with AbortError and FetchError #44297, in part)
  • 1.4.4 sent GET for method: true / 123 / {} / "GET POST" / " GET", and sent CONNECT for "CONNECT" and "connect". All of these now reject with InvalidArgumentError (UND_ERR_INVALID_ARG). undici rejects them too, except lower-case "connect", which undici sends as written and the shim would upper-case to CONNECT. (undici.request: reject a method that is not a string, not an HTTP token, or CONNECT #44814, in part)

Bun.serve

fetch, Request, Response, Headers

  • 1.4.4: (await fetch(u)).type was "default", now "basic". response.url kept #frag, now drops it. new Response(null, {status: 101}).type was "error", now "default". data: URLs now go through the URL parser first, as in Node: the fragment is not part of the body, tabs and newlines in the URL are removed (data:text/plain,a\nb is ab, was a\nb), non-ASCII is percent-encoded in response.url, and DATA: works. (fetch: set Response.type and exclude URL fragments per the fetch spec #33499)
  • 1.4.4 dropped a leading BOM: a urlencoded body \uFEFFhello=world gave get('hello') === 'world'. Now the key is \uFEFFhello, and a multipart value \uFEFFbom keeps its BOM. (fetch: preserve a leading UTF-8 BOM in formData() #33631)
  • 1.4.4: data:text/plain,x had Content-Type and blob().type text/plain;charset=utf-8, now text/plain; data:application/json,{} had application/json;charset=utf-8, now application/json; data:,x had no Content-Type header, now text/plain;charset=US-ASCII. data:text/plain;BASE64,WA== returned the text WA==, now decodes to X (the marker also for import of a data: URL and the bundler). The rejection for a bad data: URL is a TypeError with code ERR_INVALID_URL, was a plain Error; same message. fetch() of base64 in the URL-safe alphabet (data:text/plain;base64,_-8=) resolved on 1.4.4 and rejects now, like Node and browsers. import and the bundler decode base64 exactly as on 1.4.4, URL-safe alphabet included. (fetch: data: URL Content-Type and fragment per the Fetch standard #34896)
  • 1.4.4 read 5\r\nhello\r\n0\r\n\r\n after a 204/304 head as a chunked body, threw it away and reused the connection. Now those bytes count as trailing junk, so the connection is closed and the next fetch opens a new one. A lone late 0\r\n\r\n on the idle pooled socket is still ignored. (http: ignore Transfer-Encoding: chunked on 1xx/204/304; remove force_last_modified #34919, in part)
  • 1.4.4: Response.redirect(u, {}) and { headers } had status 200, now 302. Response.redirect(u, "307") was 302, now 307. Nothing that returned a Response on 1.4.4 throws now: "abc", "9999", "404", "", true and false are still a 302, { status: 200 } and new Response(null) as the init are still a 200. (Response.redirect: coerce status via WebIDL ToNumber and fix {status:200} bypass #35222, in part)
  • 1.4.4 derived File.type from the filename extension or the first bytes whenever Content-Type came after Content-Disposition, which is the order every client uses. Now it's the part's Content-Type, as in Node and browsers: a.txt sent as text/plain gives text/plain (was text/plain;charset=utf-8), a.json sent as text/plain gives text/plain (was application/json;charset=utf-8), and a typeless Blob that round-trips through new Response(formData).formData() gives application/octet-stream (was empty). A malformed header line after Content-Disposition now rejects formData(). (Bun.serve, FormData: stop content-sniffing typeless Blob bodies into image/* types #35244, in part)
  • 1.4.4: after const copy = new Request(source, {}) with source built from body: "" or a zero-length view, copy.body === source.body, and reading both rejected with Body already used. Now each has its own empty body. Node moves the body, so there the source is the one that rejects. (webcore: new Request(request) transfers the body; a used or locked body throws in every copy #35858, in part)
  • 1.4.4: Headers.prototype.getSetCookie.call({}) returned undefined. Now it throws TypeError. (Headers: add brand checks to getSetCookie()/getAll()/count #36000, in part)
  • 1.4.4 sent 250 of 300 headers and got a 200. Now all 300 go out, so a server with a field limit can answer 431 (Bun.serve caps at 200 fields, Node at 2000). (fetch: send every request header instead of silently dropping past the 250th #36433)
  • 1.4.4: await fetch(fileUrlOfMissingFile) resolved with a 200 Response and .text() rejected with ENOENT. Now fetch() itself rejects, so a try/catch around only the body read no longer catches it. The rejection has syscall: "stat". The body read on 1.4.4 failed with syscall: "open". (fetch: reject file: URLs whose path cannot be read #37425)
  • Windows only: error.path and the message of a Bun.file() body that can't be opened no longer start with \\?\ (2e7317b3da). 1.4.4 reported \\?\C:\dir\missing.txt, now C:\dir\missing.txt, like .text(), a FormData part and node:fs. (fetch: reject an unreadable Bun.file() request body with a TypeError #37501)
  • 1.4.4 sent a POST/PATCH 307/308 hop on the connection that carried the 3xx, now it closes that connection and dials. GET/HEAD/PUT/DELETE hops still reuse it. The rule is by idempotency, so PROPFIND, REPORT, LOCK and every method outside Bun's table also dial on a hop that keeps the method, and so does a hop that re-sends a Bun.file() body. (fetch: only pool a redirecting connection for idempotent hops; derive the pool key in one place #37522, in part)
  • 1.4.4: Response.redirect("").headers.get("location") was null, now "". The bytes on the wire don't change (an empty Location: was already sent). A static route with Response.redirect("") now sends an empty Location: line. (Response.redirect(""): store an empty Location value instead of a null one #37893)
  • 1.4.4 followed a same-origin redirect from a unix-socket server over TCP, now it stays on the socket. A cross-origin Location still leaves the socket and drops credentials, as before. (fetch: follow same-origin redirects over the unix socket #38394)
  • 1.4.4 followed the redirect with an empty body, now it uploads the file again. A Bun.file() that isn't a regular file but reports 32 KiB or more (in practice only a big directory) takes the read path on Linux too, and still rejects. (fetch: re-send a Bun.file() body when following a redirect #38406)
  • 1.4.4 printed HTTP/1.1 GET http://... and Accept: */* on stderr, now > HTTP/1.1 GET http://... and > Accept: */*. (http: restore the "> " and "[fetch] " prefixes on verbose trace request lines #38691)
  • 1.4.4 sent the first 262,160 bytes of an endless source (Bun.file("/dev/zero"), /dev/urandom, yes | bun upload.js) and resolved. Now the read goes on, on the JS thread, until the JS buffer limit (4 GiB) and the fetch rejects with ENOMEM (5.9 s on the debug build with a 12 GB cap). Under a memory limit below about 4 GiB the process is OOM-killed first (measured with a 3 GB cgroup), same as fs.readFileSync("/dev/zero"). (fetch: stream a Bun.file() body that is a FIFO, socket, or device instead of reading it on the JS thread #41488, in part)
  • On macOS and Linux the curl line's arguments are in '...' instead of "...", and the body is printed raw instead of as a JSON string literal. Windows output is unchanged, because cmd.exe has no single quotes. (fetch, audit: write the verbose curl line and the audit fix --ignore line as shell words #41726, in part)
  • 1.4.4: fetch(url, { method: "POST", body: new URLSearchParams() }) had no Content-Type, now application/x-www-form-urlencoded;charset=UTF-8. A GET with an empty typed body (Node rejects it, Bun accepts it) now carries that Content-Type too. (fetch: send the body's Content-Type for a zero-length typed body #41752)
  • 1.4.4 ignored a non-string unix and connected to the URL's host over TCP. Now it rejects with fetch: 'unix' must be a string (ERR_INVALID_ARG_TYPE). "", null, undefined, false and 0 still mean no unix socket. (fetch: reject a non-string unix option instead of dialing the URL host over TCP #41786)
  • 1.4.4: new Request(put, init) was a GET when init was a Proxy, array, function, Headers, URL, Blob or Response, or when input was not a native Request; now it keeps the input's method. new Request(url, { status: 0 }) threw RangeError, now constructs (status and statusText are no longer read from a RequestInit). new Request(url, new Response(null, { method: "DELETE" })).method was DELETE, now GET. An init.method getter is read once, not twice. (Request: take a method from RequestInit only when it has one #41994)
  • 1.4.4 pooled a connection that sent bytes after the last chunk of a chunked response. Now it closes it and the next fetch dials a new one, which costs a broken server's clients one connection per request. Unchanged from 1.4.4: exactly one extra \r\n, or a repeated 0\r\n\r\n, in the same read as the last chunk still pools, and any byte but a late 0\r\n\r\n on an idle pooled connection still closes it. Bytes after the last chunk of a response now close the connection instead of pooling it. That includes a lone extra CRLF, which 1.4.4 and Node tolerate. The cost is one more dial for the next request. (fetch: never pool an HTTP/1.1 connection that received bytes past the end of a response #42091, in part)
  • 1.4.4 copied the native header list and never looked at Symbol.iterator. A Headers object whose iterator was overridden (subclass, own property, patched Headers.prototype[Symbol.iterator]) now contributes what the iterator yields, with lowercase names on the wire, and throws if it yields something other than pairs. A plain Headers or a subclass that doesn't touch the iterator is still copied, name case included. (HeadersInit: honor an overridden Symbol.iterator on a Headers object #43023)
  • 1.4.4: fetch.preconnect("s3://bucket:9000/key") returned and dialed bucket:9000 as a plain TCP host. Now it throws URL must be HTTP or HTTPS, like --fetch-preconnect. s3://bucket/key threw before (Invalid port) and still throws. (fetch: accept a preconnect URL that has no port #43034)
  • 1.4.4 delivered res.status 99, 20 or 1000 over HTTP/3 for such a :status. Now the request fails with HTTP3ProtocolError. (fetch: treat a :status of 101 as malformed over HTTP/2 and HTTP/3 #43618)
  • 1.4.4 uploaded the first 262,160 bytes of /proc/self/pagemap, /dev/zero or any slice of a device longer than that. Now a slice is uploaded whole, and a whole endless file reads up to 4 GiB on the JS thread and then rejects with ENOMEM, as fs.readFileSync does. (fetch: read a Bun.file() body with st_size 0 to EOF, up to the JS size limit #43964, in part)
  • 1.4.4 resolved a damaged gzip/deflate/br/zstd body read through a CONNECT tunnel (50,080 of 108,000 bytes for a cut gzip stream, 0 bytes for garbage). Now the body read rejects. bun install behind a proxy stops on a manifest whose gzip checksum is wrong instead of using it. (http: fail a tunnelled request with the error its callback found #44534)
  • 1.4.4 sent GET for any method string outside its table, now it's sent as written (or normalized for the six Fetch verbs). So: (1) fetch(url, { method: "LIST", body }) rejected with 'GET/HEAD cannot have body', now it's sent. (2) Bun to Bun: a Bun.serve handler saw GET and answered 200, now the server closes the connection (ECONNRESET), because Bun.serve refuses methods outside its table (Custom HTTP methods via Bun.serve() #6556). (3) fetch("s3://...", { method: "Delete" }) was a read and now deletes, "Put" uploads, and a token rejects with ERR_S3_INVALID_METHOD instead of reading. (4) TRACK, Trace, Connect were GET and are now sent as written. (fetch, Request, server.fetch: stop sending GET for a method outside the method table #44718, in part)
  • 1.4.4: await new Response("\uFEFFabc").text() was "\uFEFFabc", now "abc" (bytes(), arrayBuffer() and blob() still have the BOM). The same for text() / json(), stream.text(), Bun.readableStreamToText() and Bun.readableStreamToJSON() over an async iterable, a node Readable or a direct stream whose bytes start with EF BB BF. A program that reads such a body with text() and serves it again no longer passes the BOM through. (fetch, streams: drop one leading UTF-8 BOM in text() and json() of string and stream bodies #45486, in part)
  • 1.4.4 reused an idle connection for up to 300 s whatever Keep-Alive: timeout=N said. Now it's reused for max(N - 2, N / 2) seconds: 0.5 s for N = 1, 1 s for 2, 1.5 s for 3, 2 s for 4, N - 2 from 5 on. Only timeout=0 is never pooled. A FetchSession with idleTimeout: 1 reused a connection for up to 8 s, now 1 s. Servers see a FIN instead of an RST when Bun's idle timer closes a pooled connection. An idle pooled socket is closed 5 to 6 minutes after it went idle (1.4.4: 4 to 5). Reuse still stops at 300 s. (fetch: stop reusing a pooled keep-alive connection before the origin closes it #45497, in part)
  • 1.4.4: the header was null in all these cases. One Bun.serve shape changes: const r = new Response(Bun.file(p).slice(5, 10)); return new Response(r.body, { headers: r.headers }) was a 206 with Content-Range because r.headers was empty after .body; now r.headers has the type, so it counts as handler-supplied headers and is a 200, as it already was when r.headers was read before r.body. After .body was read or the Response was copied, Bun.serve sends the type from Bun.file(path, { type }) instead of the type of the file extension, and writes the header name as Content-Type instead of content-type. A string body has no type in .headers, before or after it is read, as on 1.4.4. (Keep the body's Content-Type on Response and Request after the body is consumed #45601)
  • 1.4.4 (since Response.clone(): share tee chunk refs instead of StructuredClone per branch #35843, July): both bodies handed script the same Uint8Array object, which was also the producer's object. Now each script read on a cloned body or its clone is a new object over a new buffer of exactly the chunk's length, with the same type (a Buffer stays a Buffer). That costs one allocation and one memcpy per chunk per body read by script. PR's numbers for 64 MB in 1,024 chunks with both bodies read by reader.read(): 2.0 to 3.6x slower (release). .text(), .json(), .arrayBuffer(), .bytes(), .blob(), Bun.serve sending the body and clone chains still copy nothing extra. ReadableStream.prototype.tee() still shares the chunk object. A chunk that script reads from a cloned body loses own properties set on the producer's chunk, and tee() of a clone's body hands out two different objects. (Response.clone(): copy a chunk when a body-clone branch hands it to script #46080, in part)
  • 1.4.4 sent Content-Type: with an empty value for these bodies, so a receiver's headers.get('content-type') was "". Now the header is absent (null). (Blob: treat an empty type as no Content-Type in fetch and Bun.serve routes #46194)
  • 1.4.4: Response.json({ toJSON() {} }), a toJSON that returns a function or symbol, a callable Proxy and a built-in constructor such as Date gave 200, Content-Type: application/json and an empty body. Now they throw a TypeError, so a Bun.serve route that returns one answers 500. Response.json(1n) still throws a TypeError, but the message is JSC's JSON.stringify cannot serialize BigInt. instead of V8's Do not know how to serialize a BigInt, the same text Response.json({ n: 1n }) already had. (Response.json: throw TypeError when JSON.stringify returns undefined #46397)

Other

  • 1.4.4 returned the first member and ignored the rest of the input. Now bytes after a member that start with 1f 8b are decoded as the next member, so the result is longer, and a truncated or corrupt later member throws. Any other trailing bytes (zero padding, junk) are still ignored, where Node throws on non-zero junk. (zlib: decode all members of a concatenated gzip stream, not just the first #31522, in part)

@Jarred-Sumner

Jarred-Sumner commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

All behavior changes, part 2: node:http, node:http2, HTTP/3 and node:quic

Programs that ran without an error on 1.4.4 and behave differently now.

node:quic

HTTP/3

node:http2

node:http and node:https

Not included

Left for a maintainer to decide (features, changed defaults, trust decisions, performance trade-offs):

Already fixed on main: #18410, #18798, #19357, #25758, #30943, #31359, #31488, #31520, #31842, #33061, #35018, #35535, #35538, #35713, #35741, #35763, #37445, #37511, #37543, #37782, #37884, #38082, #38124, #38636, #38673, #39639, #39889, #41337, #41338, #41391, #41874, #42197, #42334, #42579, #42905, #43273, #43449, #43461, #43498, #43614, #43632, #44146, #44457, #44751, #44984, #45026, #45380, #45801.

Duplicates of a PR that is included: #31055, #33578, #37600, #37690, #37951, #38109, #39731, #41560, #42410, #43523, #43866, #44015, #44236, #45822, #45875.

Skipped (refactor only, needs a vendor change, Node disagrees, or no real program hits it): #28342, #31058, #31745, #31983, #32020, #32707, #33619, #33877, #35138, #35411, #35522, #35731, #35732, #35762, #35897, #36110, #36563, #37437, #37446, #37547, #37553, #37554, #37558, #37566, #37568, #37588, #37609, #37649, #37676, #37694, #37703, #37706, #37722, #37805, #37875, #37945, #38078, #38181, #38345, #38644, #39262, #40290, #41322, #41446, #41493, #41494, #41502, #41546, #41564, #41607, #42021, #42190, #42278, #42357, #42391, #42397, #42461, #42485, #42858, #42862, #42901, #42907, #42919, #43017, #43041, #43299, #43337, #43395, #43424, #43441, #43465, #43491, #43501, #43526, #43536, #43550, #43554, #43578, #43583, #43585, #43587, #43609, #43617, #43619, #43677, #43744, #44310, #44323, #44338, #44347, #44510, #44654, #44871, #44881, #44930, #45017, #45058, #45098, #45174, #45398, #45399, #45476, #45532, #45603, #45876, #45913, #46009, #46046, #46056, #46137, #46212, #46261, #46380, #46403.

@robobun

robobun commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator
Updated 9:42 AM PT - Oct 23rd, 2026

✅ @Jarred-Sumner, your commit 52353410b0378b7c3036db33811cef0392eb683b passed in Build #131342! 🎉

🧪   To try this PR locally:

bunx bun-pr 46528

That installs a local version of the PR into your bun-46528 executable, so you can run:

bun-46528 --bun

claude[bot]
claude Bot reviewed Oct 22, 2026
View reviewed changes
Comment thread src/js/thirdparty/undici.js Outdated
claude[bot]
claude Bot reviewed Oct 22, 2026
View reviewed changes
Comment thread src/js/thirdparty/undici.js Outdated
claude[bot]
claude Bot reviewed Oct 22, 2026
View reviewed changes
Comment thread src/resolver/data_url.rs Outdated
claude[bot]
claude Bot reviewed Oct 22, 2026
View reviewed changes
Comment thread packages/bun-uws/src/HttpResponse.h Outdated
claude[bot]
claude Bot reviewed Oct 22, 2026
View reviewed changes
Comment thread src/http/h3_client/callbacks.rs
claude[bot]
claude Bot reviewed Oct 22, 2026
View reviewed changes
Comment thread src/js/node/http2.ts
claude[bot]
claude Bot reviewed Oct 22, 2026
View reviewed changes
Comment thread src/js/node/http2.ts Outdated
claude[bot]
claude Bot reviewed Oct 22, 2026
View reviewed changes
Comment thread src/http/h3_client/AltSvc.rs
claude[bot]
claude Bot reviewed Oct 22, 2026
View reviewed changes
Comment thread packages/bun-uws/src/Http3Context.h Outdated
claude[bot]
claude Bot reviewed Oct 22, 2026
View reviewed changes

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Beyond the inline findings, two other candidates were examined and ruled out: the Keep-Alive: timeout=N handling in src/http/lib.rs (around line 5224) drops pooling only when N minus the 2 s margin reaches zero, matching undici's keepAliveTimeoutThreshold semantics rather than disabling reuse broadly; and the +32 per-field estimate in lshpack_wrapper_encode_block (src/jsc/bindings/c-bindings.cpp:588) is backed by lshpack_enc_encode being bounded by the end pointer, so an undersized buffer surfaces as the SIZE_MAX error return, not an overflow.

Extended reasoning...

The change is a 404-file, roughly 44k-line consolidation across fetch, Bun.serve, node:http, node:http2, HTTP/3, node:quic and the undici/node-fetch shims, including new lsquic/lsqpack patches and uWS/usockets C/C++ changes, which is TLS- and parser-adjacent security-sensitive surface. Ten inline findings are being posted, so a human review is already signaled; this body only records two further candidates checked against the code and found not to be bugs.

Findings marked 🟡 are optional suggestions and need no follow-up push.

Additional findings (outside the current diff — GitHub can't attach inline comments there):

  • 🟡 src/runtime/webcore/fetch.rs:1668 — Programs that pass a FIFO, a device or /dev/stdin via Bun.file() as a fetch() body now buffer the whole source in memory before sending; a long-lived producer grows RSS until the process is killed. The non-regular path breaks out of sendfile at src/runtime/webcore/fetch.rs:1661 into a full read, and src/runtime/node/node_fs.rs:7289-7290 marks the size unknown and drops has_max_size, so the read runs to EOF with no cap. The base stopped at 262,160 bytes; the only brake is the Linux-only ENOMEM check at node_fs.rs:6879, which fires at total system memory. Fix: stream non-regular bodies (chunked transfer) or keep a bounded in-memory cap and reject beyond it with a clear error, on every platform. [also at: src/runtime/node/node_fs.rs:7291 - A fetch() or Response whose body is Bun.file() over a pipe, FIFO or character device now buffers the whole stream in memory before sending; on the base branch the read stopped at 262,160 bytes.]

    Why this was flagged

    The trigger is any fetch() whose body is Bun.file() over a non-regular file: Bun.file("/dev/stdin") piped from a long producer, a named pipe, or a device, entering through fetch() at src/runtime/webcore/fetch.rs:1661 where !S::ISREG leaves the sendfile path and the body is read into memory. In the read path src/runtime/node/node_fs.rs:7289 sets size_unknown for any non-regular file and src/runtime/node/node_fs.rs:7290 clears has_max_size, so the loop reads until EOF with no limit. On the base branch the read stopped after 262,160 bytes (wrong, but bounded); after this change a slow or endless producer makes RSS grow without bound and the process is OOM-killed. The safeguard should_throw_out_of_memory_early_for_javascript (node_fs.rs:6879) only triggers at the machine's total memory and only on Linux, so on macOS and in containers with cgroup limits the kill arrives first. Remedy: stream such bodies with chunked encoding, or enforce a bounded cap and surface an error.

    Verification: src/runtime/webcore/fetch.rs:1661-1663 breaks out of sendfile for every non-regular fd. src/runtime/node/node_fs.rs:7289-7290 make has_max_size false, so the growth arm at 7363-7378 keeps extending the Vec until read returns 0. On base the loop stopped at 262,160 bytes. Lines 7291-7292 set limit_size_for_javascript, so node_fs.rs:6879-6899 rejects with ENOMEM once total > synthetic_allocation_limit().

claude[bot]
claude Bot reviewed Oct 22, 2026
View reviewed changes

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Findings marked 🟡 are optional suggestions and need no follow-up push.

Comment thread packages/bun-uws/src/HttpParser.h Outdated
This was referenced Oct 22, 2026
Closed
Open
Open
claude[bot]
claude Bot reviewed Oct 22, 2026
View reviewed changes

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Comment thread src/js/node/http2.ts Outdated
Comment thread packages/bun-uws/src/HttpContext.h
Comment thread src/js/thirdparty/undici.js
@igorls igorls mentioned this pull request Oct 22, 2026
Open
8 tasks
claude[bot]
claude Bot reviewed Oct 22, 2026
View reviewed changes

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Findings marked 🟡 are optional suggestions and need no follow-up push.

Comment thread src/http_types/Method.rs
Comment thread src/js/node/_http_server.ts Outdated
Comment thread src/js/node/http2.ts Outdated
This was referenced Oct 23, 2026
Open
Open
Open
Jarred-Sumner and others added 4 commits October 23, 2026 08:58
@Jarred-Sumner
socket: close a paused socket whose queued write failed, and report a…
851a8c3 
… peer's reset under held TLS records as a failed read again
@Jarred-Sumner
Give each HTTP rule one owner: one node:http server per kind of conne…
ebb4da0 
…ction, plain sockets for req.socket, one http2 stream table, one in-flight table for fetch, one QUIC transport layer
@autofix-ci
[autofix.ci] apply automated fixes
a3ae79f
@Jarred-Sumner
Fix the lint, clippy and mordant findings
525fdb4
claude[bot]
claude Bot reviewed Oct 23, 2026
View reviewed changes

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Comment thread src/runtime/api/bun/h2/connection.rs Outdated
Comment thread src/js/node/_http_server.ts Outdated
Comment thread src/runtime/webcore/Request.rs
claude[bot]
claude Bot reviewed Oct 23, 2026
View reviewed changes

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Still open from earlier reviews (2):

  • Unresolved: 2 minor or pre-existing.

Comment thread src/runtime/socket/node_http_socket.rs Outdated
Comment thread src/js/thirdparty/undici.js Outdated
@robobun

robobun commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator

A case that the _consuming flag in parserOnMessageComplete (src/js/node/_http_common.ts:245) does not cover. I found it while I worked on the same defect: on emit('connection') and allowHTTP1 connections, the response's 'finish' dumps a request body that the listener is reading.

With the flag, the body is kept when the 'request' listener begins to read synchronously. The body is still lost when the listener begins to read in a microtask or in a process.nextTick. An async listener with one await before it reads is the usual form. That form works in 1.4.2 and is broken since 1.4.3.

const http = require("node:http"), net = require("node:net"), { Writable } = require("node:stream");
const server = http.createServer(async (req, res) => {
  await null;
  let got = 0;
  const slow = new Writable({ highWaterMark: 1, write(c, _e, cb) { got += c.length; setImmediate(cb); } });
  slow.on("finish", () => { console.log(got); process.exit(0); });
  req.pipe(slow);
  res.end();
});
const acceptor = net.createServer(s => server.emit("connection", s)).listen(0, "127.0.0.1", () => {
  const parts = [Buffer.from("POST / HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\n\r\n")];
  for (const fill of "abcd") parts.push(Buffer.from("400\r\n"), Buffer.alloc(1024, fill), Buffer.from("\r\n"));
  parts.push(Buffer.from("0\r\n\r\n"));
  const c = net.connect(acceptor.address().port, "127.0.0.1", () => c.write(Buffer.concat(parts)));
  c.resume();
});
Runtime Output
Node v26.3.0 4096
Bun 1.4.2 4096
main (9634520) 1024
this PR at 525fdb4, release build, Linux x64 1024
this PR, without the await null 4096

Cause. One parser.execute() call parses the whole read, so the EOF is pushed before the microtask runs. At that time nothing is scheduled on the request, and the flag stays false. Node's parser consumes the handle and calls kOnBody through MakeCallback (src/node_http_parser.cc:523). The nextTick queue and the microtasks run after each body chunk, so _read() runs before the EOF.

Extent. I ran a matrix of 4 framings, 6 ways to read and 4 start times (96 cases) on a net.Socket given to emit('connection'). This PR equals Node in 60 cases (main: 51). 15 cases still lose bytes or 'end':

  • 14 are the microtask and nextTick starts of once('data') then pause(), on('data') and pause(), 'readable' and read(n), and pipe() into a slow Writable. Chunked and Content-Length bodies both.
  • 1 is a synchronous start: once('data') then pause() with a Content-Length body. The bytes arrive, but 'end' fires while the request is paused, so an 'end' listener that is added after the answer never runs.

An HTTP/1.1 client of an http2 server with allowHTTP1 loses the body in the same microtask and nextTick cases.

claude[bot]
claude Bot reviewed Oct 23, 2026
View reviewed changes

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Findings marked 🟡 are optional suggestions and need no follow-up push.

Still open from earlier reviews (3):

  • Unresolved: 3 minor or pre-existing.

Comment thread src/js/node/_http_outgoing.ts Outdated
Comment thread src/js/thirdparty/undici.js Outdated
claude[bot]
claude Bot reviewed Oct 23, 2026
View reviewed changes

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Findings marked 🟡 are optional suggestions and need no follow-up push.

Still open from earlier reviews (2):

  • 🔴 src/js/node/_http_outgoing.ts:379 — http.request() callers that cork, write a chunk of 64 KiB (16 KiB on Windows) or more, uncork and then wait for 'drain'…
  • Also unresolved: 1 minor or pre-existing.

If you have decided not to act on one of these findings, resolve its thread (a reply alone leaves it open) and the next review stops counting it. To review this commit again now, use Re-run on its "Claude Code Review" check.

Comment thread src/runtime/webcore/Body.rs
Comment thread src/js/node/_http_server.ts Outdated
Comment thread src/js/thirdparty/undici.js
@robobun

robobun commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator

I worked on the same Bun.file() redirect loss (#38406) before I saw this PR. I did not open my branch as a PR, because this PR already has the fix. I ran the tests of that branch against a debug build of a919d6b.

What this PR fixes. A grid of 40 cells (5 sizes, http or https target, 307 or 308, Bun.file() or Buffer) arrives whole in 40 of 40 cells. Bun 1.4.3 loses 12. 21 of my 28 tests pass. They include a hop through a CONNECT tunnel and a hop through a TLS proxy.

What still differs. Each item has a test on the branch.

  1. Keep-alive retry. A PUT of a Bun.file() of 32768 bytes on a reused connection that the server drops rejects with ECONNRESET. The same PUT with 32767 bytes is sent again. retries_on_close admits only Bytes (test).
  2. A file that gets shorter during the upload. SendFile::write and write_copy return Done at the end of the file with bytes still owed, so the request counts as sent. With Bun.serve as the peer, the fetch rejects with ECONNRESET after 12 s, when the server times the request out (first hop, redirected hop).
  3. With BUN_FEATURE_FLAG_EXPERIMENTAL_HTTP2_CLIENT, a file body that a plain http origin redirects to an origin that speaks only h2 rejects with EPROTO. A Sendfile body keeps that hop on HTTP/1.1 (test).

Are 1 and 2 deliberate? If they are not, I can send each as a small change on top of this branch.

Branch: robobun/e2e008f6/fetch-file-body-replay. Its diff sends the file again from the descriptor that the caller queued: with sendfile(2) on a plain hop, and as a FileReader stream on every other hop.

@robobun robobun mentioned this pull request Oct 23, 2026
Open
@Jarred-Sumner
node:http: deliver a request body that is read after an await, end a …
d132a01 
…handed-off socket as before when its connection fails, and address review comments
@Jarred-Sumner

Jarred-Sumner commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator Author

@robobun on the Bun.file() bodies: thanks for running your tests against this branch. Neither 1 nor 2 was deliberate, and both are older than this PR. Both are fixed in d132a01.

  1. The retry after a dropped keep-alive connection only knew how to replay an in-memory body, so it depended on whether the file was small enough to be read into memory. Now a file body is rewound and sent again under exactly the same conditions as a Buffer (reused connection, idempotent method, nothing of a response body seen). A redirected hop with a file body also reuses its connection now, like any other hop.
  2. An upload whose file becomes shorter while it's being sent used to count as sent and then wait for the server to give up. It now rejects right away with ERR_HTTP_CONTENT_LENGTH_MISMATCH, on the first hop and on a redirected one, which is also what Node does for a body that ends short of its Content-Length.
  3. That one is a known limit of the experimental flag: a body sent from a file descriptor stays on HTTP/1.1. This PR doesn't change it.

So there's no need for changes on top. If one of your 28 tests still fails on that commit apart from 3, tell me which.

claude[bot]
claude Bot reviewed Oct 23, 2026
View reviewed changes

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Findings marked 🟡 are optional suggestions and need no follow-up push.

Comment thread src/js/node/net.ts
Comment thread src/js/node/_http_common.ts Outdated
Comment thread src/http/SendFile.rs
@Jarred-Sumner

Jarred-Sumner commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator Author

@robobun on the request body that a listener starts to read after an await: confirmed, thanks, and fixed in d132a01. On these connections the parser now runs the tick queue and the microtasks where Node's parser does, and the _consuming flag in parserOnMessageComplete is gone. I built the same kind of matrix (4 framings x 6 ways to read x 4 start times, bytes and events). On a net.Socket given to emit('connection') it now equals Node 26.12.1 in all 96 cases. On allowHTTP1 the bytes are equal in all 96, and 27 cases differ only in when the response's 'finish' fires, because a TLS write completes later in Node. Six of the 96 needed two small changes from Node 26.12's IncomingMessage.

@robobun robobun mentioned this pull request Oct 23, 2026
Open
@robobun

robobun commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator

node:http2: a closed stream with unread data at session teardown (#43433 in this PR)

I ran the case behind #43433 on this branch at d132a01 (debug build, Linux x64). A client sends a request, reads the status only, and waits for 'close'. The server answers in full, then drops the connection. The table counts the requests that never get 'close', in 20 runs of 50 requests (first script at the end).

Runtime Peer FIN Peer RST
Node v26.3.0 0 of 1,000 0 of 1,000
main fec4a88 1,000 of 1,000 1,000 of 1,000
This PR 0 of 1,000 0 of 1,000

This PR fixes that case. I found two gaps next to it.

1. No test covers the transport-loss door

  • I removed the call settleUnreadClosedStreams(unread, err, closedAndIdle, true) from ClientHttp2Session.#onClose (src/js/node/http2.ts:5434). The hang came back on a peer FIN: 50 of 50.
  • bun bd test test/js/node/http2/ still passed without that call: 1,068 pass, 0 fail, the same result as with it.
  • The block "a stream that closed with its data unread" tests destroy(), destroy(err) and close(). node:http2: destroy a closed stream with unread data when its session is torn down #43433 also had tests for a peer FIN and a socket error. The smaller block did not keep them.

The test below goes in that block. Its ends row fails without the call at :5434 (an assertion, after about 120 ms). Both rows pass with it. I ran the resets row on Linux only.

    // A request that looks at the status only, then the server drops the connection. No GOAWAY comes first.
    it.each([
      ["ends", socket => socket.end(), []],
      ["resets", socket => socket.resetAndDestroy(), ["ECONNRESET"]],
    ])("is destroyed when the peer %s the connection", async (_, drop, expected) => {
      const server = http2.createServer((req, res) => res.end("hello"));
      const accepted = once(server, "connection");
      await once(server.listen(0, "127.0.0.1"), "listening");
      const client = http2.connect(`http://127.0.0.1:${server.address().port}`);
      try {
        client.on("error", () => {});
        const sessionClosed = new Promise(resolve => client.on("close", resolve));
        const req = client.request({ ":path": "/", ":method": "POST" });
        const events = [];
        req.on("error", err => events.push(err.code));
        req.on("close", () => events.push("close"));
        req.end("fire and forget");
        await once(req, "response");
        await roundTrip(client);
        expect({ closed: req.closed, destroyed: req.destroyed }).toEqual({ closed: true, destroyed: false });
        const [socket] = await accepted;
        drop(socket);
        await sessionClosed;
        expect({ destroyed: req.destroyed, events, rstCode: req.rstCode }).toEqual({
          destroyed: true,
          events: [...expected, "close"],
          rstCode: NGHTTP2_NO_ERROR,
        });
      } finally {
        client.destroy();
        server.close();
      }
    });

2. In 19 of 77 teardown cells the stream gets no 'close' at teardown

The stream is complete on the wire and holds unread data. Then its session is torn down. The second script at the end runs 11 ways to tear the session down, with 4 reader states on the client and 3 on the server.

Runtime Cells where the stream is destroyed
Node v26.3.0 77 of 77
main fec4a88 0 of 77
This PR 58 of 77, each with the same stream events as Node

The other 19 cells come from two lines of settleUnreadClosedStreams. In each of them destroyed stays false and the bytes stay readable. 'close' comes only after the program reads the stream to its end.

Line Cells Node v26.3.0 This PR
http2.ts:4966. The transport goes away with no error (a peer FIN, or socket.destroy() on the same side). The stream has a reader that does not read: pause(), a 'readable' listener, or on('data') then pause(). 12 (6 client, 6 server) 'close'. The unread bytes are dropped. No event
http2.ts:4963. session.close(), then session.destroy() in the same tick. Each reader state. 7 (4 client, 3 server) 'close'. The unread bytes are dropped. No event

The line at :4966 keeps data that Node drops. I measured that side too. A server consumes a 61,440-byte request body slowly. The client reads the response, then closes its socket.

Consumer of the server stream Node v26.3.0 This PR
pipe(), pipeline(), for await, or 'data' with pause() and resume() 16,384 bytes, then 'close' with no 'end' 61,440 bytes, 'end', 'close'
pipe() into a sink that never drains 'close' No 'close'
  • Without the line at :4966, its 12 cells match Node (70 of 77). A slow consumer then loses the bytes it has not read at the FIN, as on Node: for await got 49,122 of 61,440 bytes in 5 of 5 runs.
  • No test covers the line at :4966. test/js/node/http2/ passes with it and without it (1,068 pass, 0 fail).
  • Without the line at :4963, its 7 cells match Node, and the test "stays readable after client session.close()" fails. A fix for these cells has to tell a destroy() that the program calls from the end of a graceful close.
  • The list "Where this PR still differs from Node on purpose" has neither rule. Is each rule intended?

One more difference is outside these counts. In the cells that carry an error, the session's 'error' comes before the stream's 'error' on this PR. On Node it comes after the stream's 'close'.

Script for the first table

Run DROP_MS=2500 <runtime> fire-and-forget.js fin and ... rst. The delay gives a debug build time to finish all 50 exchanges before the server drops the connections.

// 10 sessions x 5 requests. Each request reads the status only and waits for 'close'.
// The server answers in full, then drops each connection DROP_MS after it accepted it.
const http2 = require("node:http2");
const net = require("node:net");
const { once } = require("node:events");
const how = process.argv[2] || "fin";
const h2 = http2.createServer();
h2.on("sessionError", () => {});
h2.on("stream", stream => {
  stream.on("error", () => {});
  stream.resume();
  stream.respond({ ":status": 200 });
  stream.end("x".repeat(1000));
});
const listener = net.createServer(socket => {
  socket.on("error", () => {});
  h2.emit("connection", socket);
  setTimeout(() => (how === "rst" ? socket.resetAndDestroy() : socket.destroy()), Number(process.env.DROP_MS || 150));
});
let started = 0;
let settled = 0;
async function fire(session) {
  started++;
  const req = session.request({ ":method": "POST", ":path": "/" });
  req.on("error", () => {});
  req.end("hello");
  try {
    await once(req, "response");
    await once(req, "close");
  } catch {
  } finally {
    settled++;
  }
}
listener.listen(0, "127.0.0.1", async () => {
  const sessions = [];
  for (let i = 0; i < 10; i++) {
    const session = http2.connect("http://127.0.0.1:" + listener.address().port);
    session.on("error", () => {});
    sessions.push(new Promise(resolve => session.on("close", resolve)));
    for (let j = 0; j < 5; j++) fire(session);
  }
  await Promise.all(sessions);
  await new Promise(resolve => setTimeout(resolve, 300));
  console.log(JSON.stringify({ how, started, settled, stuck: started - settled }));
  process.exit(0);
});
Script for the 77 cells

Run <runtime> teardown.js <side> <door> <reader> for each combination. A server stream with the reader none is not a cell: Node and Bun read and discard its data when it closes on the wire.

// usage: <runtime> teardown.js <side> <door> <reader>
//   side:   client | server   the end that holds the stream under test
//   door:   destroy | destroy-error | destroy-code | peer-goaway | peer-fin | peer-rst |
//           socket-destroy | socket-destroy-error | timeout-destroy | close-destroy | close-destroy-error
//   reader: none | pause | readable | data-pause
// The stream under test is complete on the wire (both sides sent END_STREAM) and holds 1000 unread bytes.
// Prints the events of that stream after its session is torn down.
const http2 = require("node:http2");
const net = require("node:net");
const [side = "client", door = "peer-fin", reader = "none"] = process.argv.slice(2);
const events = [];
function watch(stream) {
  stream.on("error", err => events.push("error " + err.code));
  stream.on("end", () => events.push("end"));
  stream.on("close", () => events.push("close"));
  if (reader === "pause") stream.pause();
  if (reader === "readable") stream.on("readable", () => {});
  if (reader === "data-pause") stream.on("data", () => {}).pause();
}
function ignore(stream) {
  stream.on("error", () => {});
  stream.resume();
}
let serverStream, serverSession, serverSocket, clientSocket;
const server = http2.createServer();
server.on("sessionError", () => {});
server.on("session", session => (serverSession = session).on("error", () => {}));
const gotStream = new Promise(resolve =>
  server.on("stream", stream => {
    serverStream = stream;
    (side === "server" ? watch : ignore)(stream);
    stream.respond({ ":status": 200 });
    stream.end("x".repeat(1000));
    resolve();
  }),
);
const listener = net.createServer(socket => {
  serverSocket = socket;
  socket.on("error", () => {});
  server.emit("connection", socket);
});
listener.listen(0, "127.0.0.1", async () => {
  const { port } = listener.address();
  const client = http2.connect(`http://127.0.0.1:${port}`, {
    createConnection: () => (clientSocket = net.connect(port, "127.0.0.1")),
  });
  client.on("error", () => {});
  const req = client.request({ ":method": "POST", ":path": "/" });
  const responded = new Promise(resolve => req.on("response", resolve));
  (side === "client" ? watch : ignore)(req);
  req.end("y".repeat(1000));
  await Promise.all([gotStream, responded]);
  // Both ends have every frame of the exchange once the second PING is acknowledged.
  await new Promise(resolve => client.ping(resolve));
  await new Promise(resolve => client.ping(resolve));
  const [stream, session, socket, peerSession, peerSocket] =
    side === "client"
      ? [req, client, clientSocket, serverSession, serverSocket]
      : [serverStream, serverSession, serverSocket, client, clientSocket];
  const before = { closed: stream.closed, destroyed: stream.destroyed, unread: stream.readableLength };
  const sessionClosed = new Promise(resolve => session.on("close", resolve));
  if (door === "destroy") session.destroy();
  if (door === "destroy-error") session.destroy(new Error("boom"));
  if (door === "destroy-code") session.destroy(http2.constants.NGHTTP2_CANCEL);
  if (door === "peer-goaway") peerSession.goaway(http2.constants.NGHTTP2_ENHANCE_YOUR_CALM);
  if (door === "peer-fin") peerSocket.end();
  if (door === "peer-rst") peerSocket.resetAndDestroy();
  if (door === "socket-destroy") socket.destroy();
  if (door === "socket-destroy-error") socket.destroy(new Error("boom"));
  if (door === "timeout-destroy") session.setTimeout(50, () => session.destroy());
  if (door === "close-destroy" || door === "close-destroy-error") {
    session.close();
    session.destroy(door === "close-destroy" ? undefined : new Error("boom"));
  }
  await sessionClosed;
  await new Promise(resolve => setTimeout(resolve, 300));
  console.log(JSON.stringify({ side, door, reader, before, events, destroyed: stream.destroyed }));
  process.exit(0);
});

@robobun

robobun commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

@Jarred-Sumner None apart from 3. On d132a01 23 of the 28 tests pass. Three of the other five fail only on message text, and two are item 3. 6e8e435 has the same result.

I ran the set five times on a debug build and five times on a release build of each commit (Linux x64). Every run has the same result.

Tests Result on d132a01 and on 6e8e435
1. Keep-alive retry (3) Pass.
2. The file becomes shorter (3) The fetch rejects with ERR_HTTP_CONTENT_LENGTH_MISMATCH, in less than 100 ms on the release build. The tests compare the message text of my branch, and only that comparison fails.
3. h2 after a redirect (1) EPROTO, as before.
3. h3 after a redirect (1) The file arrives whole on both hops, over HTTP/1.1. The test expects an h3 session. My first comment did not name this test.
All other tests (20) Pass.

On the request body that a listener reads after an await: confirmed on both commits. The script from my comment prints 4096. I ran a matrix of the same shape against Node 26.12.1. On emit('connection') all 96 cases equal Node in bytes, 'end' and event order. On allowHTTP1 the bytes and 'end' are equal in all 96, and 27 cases differ only in the place of the response's 'finish' and 'close'. Bun 1.4.4 loses bytes or 'end' in 12 of the 96 cases on each of the two.

More checks, outside the 28 tests

Bun.file() bodies. Both commits have the same result.

  • A dropped connection has the same outcome for Bun.file() and for Buffer. The cells are PUT or POST, a reused or a new connection, a drop at the head or after the body, and 40000 or 3000000 bytes. The outcome is the same in 16 of 16 cells (Bun 1.4.4: 11).
  • 30 retries and 30 rejected uploads leave the count of open descriptors unchanged.
  • A grid of 80 redirected uploads arrives whole in 80 of 80 cells (Bun 1.4.4: 64). The cells are PUT or POST, 5 sizes, an http or https target, 307 or 308, and Bun.file() or Buffer.

Request body. A larger matrix, on the release build of 6e8e435, against Node 26.12.1. It has 12 ways to read and bodies of 4 KiB and 1 MiB, 288 cases on emit('connection') and 288 on allowHTTP1.

  • No case has fewer bytes than Node, and no case lacks an 'end' that Node emits. e02ba32 has 31 such cases.
  • On emit('connection') all 288 cases equal Node.
  • On allowHTTP1 69 cases differ only in the place of 'finish' and 'close'. In 12 cases Bun delivers bytes or an 'end' that Node drops: a body of 1 MiB that the listener begins to read in a setImmediate.
  • 96 more cases use an acceptor that reads the first bytes and puts them back with unshift() before emit('connection'). 57 equal Node. In 15 Bun delivers bytes or an 'end' that Node drops. 24 differ only in the place of a 'close' event.

The script below is that matrix. bun matrix.js run emit <path to node> prints each case that does not equal the reference.

matrix.js 
// A request body that the 'request' listener reads while it answers, case by case against a reference runtime.
//   All cases:  bun matrix.js run <emit|allowHTTP1> <path to node>
//   One case:   bun matrix.js case <emit|allowHTTP1> <framing> <reader> <start>
// allowHTTP1 reads key.pem and cert.pem beside this file.
const http = require("node:http");
const http2 = require("node:http2");
const net = require("node:net");
const tls = require("node:tls");
const fs = require("node:fs");
const path = require("node:path");
const { spawn } = require("node:child_process");
const { Writable } = require("node:stream");
const consumers = require("node:stream/consumers");

const FRAMINGS = ["chunked-one", "length-one", "chunked-split", "length-split", "chunked-big", "length-big"];
// The acceptor reads the first bytes and puts them back before it hands the socket over.
const SNIFFED = ["sniff-chunked", "sniff-length"];
const READERS = [
  "pipeSlow",
  "pipeFast",
  "flowing",
  "dataPause",
  "onceDataPause",
  "lateEnd",
  "pauseThenLate",
  "readable",
  "readableOnce",
  "forAwait",
  "forAwaitSlow",
  "buffer",
];
const STARTS = {
  sync: begin => begin(),
  microtask: begin => Promise.resolve().then(begin),
  nextTick: begin => process.nextTick(begin),
  immediate: begin => setImmediate(begin),
};

function runCase(transport, framing, reader, start) {
  // Four pieces. Each byte depends on its offset, so a lost, repeated or reordered piece shows.
  const PIECE = framing.endsWith("big") ? 256 * 1024 : 1024;
  const BODY = Buffer.alloc(4 * PIECE);
  for (let i = 0; i < BODY.length; i++) BODY[i] = (i * 31 + (i >> 8)) & 0xff;

  const result = { bytes: 0, end: false, inOrder: true, events: [], timeout: false };
  let done = false;
  function report(timeout) {
    if (done) return;
    done = true;
    result.timeout = timeout;
    // Leave time for the events that follow the end of the read.
    setTimeout(() => process.stdout.write(JSON.stringify(result) + "\n", () => process.exit(0)), timeout ? 0 : 150);
  }
  setTimeout(() => report(true), Number(process.env.WATCHDOG_MS || 2500));

  function take(chunk) {
    const from = result.bytes;
    result.bytes += chunk.length;
    if (result.bytes > BODY.length || !BODY.subarray(from, result.bytes).equals(chunk)) result.inOrder = false;
  }
  function ended(name) {
    result.end = true;
    result.events.push(name);
    report(false);
  }
  async function iterate(req, turnPerChunk) {
    try {
      for await (const chunk of req) {
        take(chunk);
        if (turnPerChunk) await new Promise(resolve => setImmediate(resolve));
      }
      ended("req:iterated");
    } catch (e) {
      result.events.push("req:iteration-error:" + (e.code || e.name));
      report(false);
    }
  }

  const readers = {
    // pipe() into a Writable that takes one chunk per turn of the loop.
    pipeSlow(req) {
      const write = (chunk, _encoding, callback) => (take(chunk), setImmediate(callback));
      req.pipe(new Writable({ highWaterMark: 1, write }).on("finish", () => ended("sink:finish")));
    },
    pipeFast(req) {
      const write = (chunk, _encoding, callback) => (take(chunk), callback());
      req.pipe(new Writable({ write }).on("finish", () => ended("sink:finish")));
    },
    flowing(req) {
      req.on("data", take).on("end", () => ended("req:end"));
    },
    // on('data') that pauses after every chunk and resumes one turn later.
    dataPause(req) {
      req.on("data", chunk => (take(chunk), req.pause(), setImmediate(() => req.resume())));
      req.on("end", () => ended("req:end"));
    },
    // once('data'), then pause(). The rest is read one turn later, with an 'end' listener added then.
    onceDataPause(req) {
      req.once("data", chunk => {
        take(chunk);
        req.pause();
        setImmediate(() => req.on("data", take).on("end", () => ended("req:end")).resume());
      });
    },
    // on('data') now, and an 'end' listener one turn later.
    lateEnd(req) {
      req.on("data", take);
      setImmediate(() => req.on("end", () => ended("req:end")));
    },
    // pause() now. The listeners and resume() come 30 ms later.
    pauseThenLate(req) {
      req.pause();
      setTimeout(() => req.on("data", take).on("end", () => ended("req:end")).resume(), 30);
    },
    // 'readable' and read(n) until null.
    readable(req) {
      req.on("readable", () => {
        for (let chunk; (chunk = req.read(512)) !== null; ) take(chunk);
      });
      req.on("end", () => ended("req:end"));
    },
    // 'readable' and one read() for each event.
    readableOnce(req) {
      req.on("readable", () => {
        const chunk = req.read();
        if (chunk !== null) take(chunk);
      });
      req.on("end", () => ended("req:end"));
    },
    forAwait: req => void iterate(req, false),
    forAwaitSlow: req => void iterate(req, true),
    buffer(req) {
      consumers.buffer(req).then(
        all => (take(all), ended("req:consumed")),
        e => (result.events.push("req:consume-error:" + (e.code || e.name)), report(false)),
      );
    },
  };
  function listener(req, res) {
    req.on("close", () => result.events.push("req:close"));
    req.on("error", e => result.events.push("req:error:" + (e.code || e.name)));
    res.on("finish", () => result.events.push("res:finish"));
    res.on("close", () => result.events.push("res:close"));
    STARTS[start](() => {
      readers[reader](req);
      // The answer goes out while the listener reads the request.
      res.end("ok");
    });
  }

  function sendRequest(socket) {
    const chunked = framing.includes("chunked");
    const framingHeader = chunked ? "Transfer-Encoding: chunked" : "Content-Length: " + BODY.length;
    const head = Buffer.from(`POST / HTTP/1.1\r\nHost: x\r\n${framingHeader}\r\n\r\n`);
    const pieces = [0, 1, 2, 3].map(i => BODY.subarray(i * PIECE, (i + 1) * PIECE));
    let parts = chunked
      ? [head, ...pieces.map(p => Buffer.concat([Buffer.from(PIECE.toString(16) + "\r\n"), p, Buffer.from("\r\n")])), Buffer.from("0\r\n\r\n")]
      : [head, ...pieces];
    // "split": the head, then each piece in a write of its own, 25 ms apart. Every other framing: one write.
    if (!framing.endsWith("split")) parts = [Buffer.concat(parts)];
    const next = () => {
      if (parts.length === 0 || socket.destroyed) return;
      socket.write(parts.shift());
      if (parts.length > 0) setTimeout(next, 25);
    };
    socket.on("error", () => {});
    socket.resume();
    next();
  }

  if (transport === "emit") {
    const server = http.createServer(listener);
    const acceptor = net.createServer(socket => {
      if (!framing.startsWith("sniff")) return void server.emit("connection", socket);
      socket.once("data", first => {
        socket.pause();
        socket.unshift(first);
        server.emit("connection", socket);
        process.nextTick(() => socket.resume());
      });
    });
    acceptor.listen(0, "127.0.0.1", () => {
      const socket = net.connect(acceptor.address().port, "127.0.0.1", () => sendRequest(socket));
    });
  } else {
    const key = fs.readFileSync(path.join(__dirname, "key.pem"));
    const cert = fs.readFileSync(path.join(__dirname, "cert.pem"));
    const server = http2.createSecureServer({ allowHTTP1: true, key, cert }, listener);
    server.listen(0, "127.0.0.1", () => {
      const options = { port: server.address().port, host: "127.0.0.1", ALPNProtocols: ["http/1.1"], rejectUnauthorized: false };
      const socket = tls.connect(options, () => sendRequest(socket));
    });
  }
}

function spawnCase(exe, args) {
  return new Promise(resolve => {
    const child = spawn(exe, [__filename, "case", ...args], { stdio: ["ignore", "pipe", "inherit"] });
    let out = "";
    child.stdout.on("data", d => (out += d));
    child.on("close", code => {
      try {
        resolve(JSON.parse(out.trim().split("\n").pop()));
      } catch {
        resolve({ bytes: -1, end: false, inOrder: false, events: ["exit " + code], timeout: false });
      }
    });
  });
}

async function runAll(transport, reference) {
  const framings = transport === "emit" ? [...FRAMINGS, ...SNIFFED] : FRAMINGS;
  const cases = [];
  for (const framing of framings)
    for (const reader of READERS) for (const start of Object.keys(STARTS)) cases.push([transport, framing, reader, start]);

  const counts = {};
  let next = 0;
  async function worker() {
    while (next < cases.length) {
      const args = cases[next++];
      const ref = await spawnCase(reference, args);
      const own = await spawnCase(process.execPath, args);
      let kind = "equal";
      if (own.bytes < ref.bytes || (ref.end && !own.end) || !own.inOrder) kind = "fewer bytes or no 'end'";
      else if (own.bytes > ref.bytes || (own.end && !ref.end)) kind = "more bytes or an 'end'";
      else if (ref.events.join() !== own.events.join()) kind = "other order";
      const group = args[1].startsWith("sniff") ? "with the acceptor that reads first" : "plain";
      (counts[group] ??= {})[kind] = (counts[group][kind] ?? 0) + 1;
      if (kind !== "equal") {
        const show = r => `${r.bytes} bytes, end ${r.end}, ${r.events.join(" ")}`;
        console.log(`${kind}: ${args.slice(1).join(" / ")}\n  reference: ${show(ref)}\n  this:      ${show(own)}`);
      }
    }
  }
  await Promise.all(Array.from({ length: Number(process.env.PARALLEL || 4) }, worker));
  console.log(transport, cases.length, "cases", JSON.stringify(counts, null, 1));
}

const [mode, ...args] = process.argv.slice(2);
if (mode === "case") runCase(...args);
else runAll(args[0], args[1]);

claude[bot]
claude Bot reviewed Oct 23, 2026
View reviewed changes

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Findings marked 🟡 are optional suggestions and need no follow-up push.

Comment thread packages/bun-usockets/src/bsd.c
Comment thread test/js/node/http/node-http.test.ts
@Jarred-Sumner
node:http2, node:http, usockets: session.destroy() after close(), unc…
5235341 
…ork() with nothing corked, and the timeout sweep's timer
@Jarred-Sumner

Jarred-Sumner commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator Author

Thanks, all of your numbers reproduce here. As of 5235341:

  • session.close() followed by session.destroy(): not intended, and fixed. A session.destroy() that the program calls now destroys these streams even right after session.close(), as in Node. Only the session's own end of a graceful close leaves them readable. 65 of the 77 cells now match Node.
  • A reader that is paused when the session ends without an error: intended. A stream that is already complete and has a reader keeps what it has buffered, so a slow consumer gets every byte, then 'end' and 'close', as on 1.4.x, where Node drops the rest without an error. Nothing in the runtime holds such a stream once its session is gone, so one that the program drops is collected.
  • The session's 'error' before the stream's: the 1.4.x order, left as it is.

The last two go on the list of intended differences. You were right that no test covered the path where the connection ends: the block has 7 new tests, for both sides of that path, and each fails when the line it covers is removed.

claude[bot]
claude Bot reviewed Oct 23, 2026
View reviewed changes

@claude claude Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Comment thread src/runtime/socket/FdPipe.rs
@robobun

robobun commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator

Confirmed on 5235341 (debug build, Linux x64, against Node 26.12.1).

  • 65 of the 77 cells have the same stream events as Node. The 7 cells of session.close() then session.destroy() are among them. The other 12 are the paused-reader rule: 6 on the client and 6 on the server.
  • Each of the 7 new tests fails when its line is removed. The two ends rows fail without the calls in #onClose, and the reset row fails without the call in destroy().
  • A stream that stays readable is collected after the program drops it. I counted with a FinalizationRegistry: 100 of 100 streams in each of the 6 combinations of side and reader, with their sessions and sockets.

@robobun robobun mentioned this pull request Oct 23, 2026
Open

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment