https: limit proxy CONNECT response headers

[mcollina]

• enforce the effective HTTP maximum header size while reading HTTPS proxy CONNECT responses
• use a one-shot readable listener while waiting for additional response data
• add regression coverage for fragmented, incomplete proxy response headers

[nodejs-github-bot]

Review requested:

• @nodejs/crypto
• @nodejs/http
• @nodejs/net

[codecov]

Codecov Report

❌ Patch coverage is 95.83333% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.28%. Comparing base (cf882a7) to head (34ef7aa).
⚠️ Report is 761 commits behind head on main.

Files with missing lines	Patch %	Lines
lib/https.js	95.83%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #64545      +/-   ##
==========================================
+ Coverage   90.24%   90.28%   +0.04%     
==========================================
  Files         739      762      +23     
  Lines      241667   247537    +5870     
  Branches    45550    46690    +1140     
==========================================
+ Hits       218093   223501    +5408     
- Misses      15109    15480     +371     
- Partials     8465     8556      +91     

Files with missing lines	Coverage Δ
lib/https.js	97.18% <95.83%> (-1.05%)	⬇️

... and 201 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/74869/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/75591/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/76870/

[nodejs-github-bot]

Commit Queue failed

✘ GitHub CI is still running

The pull request was removed from the Commit Queue and labeled commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. . After resolving the failure, remove that label and add commit-queue PRs queued for automated landing through the Commit Queue. to retry.

Full Commit Queue output

- Loading data for nodejs/node/pull/64545
✔  Done loading data for nodejs/node/pull/64545
----------------------------------- PR info ------------------------------------
Title      https: limit proxy CONNECT response headers (#64545)
Author     Matteo Collina <matteo.collina@gmail.com> (@mcollina)
Branch     mcollina:fix/https-proxy-connect-header-limit -> nodejs:main
Labels     https, needs-ci, commit-queue
Commits    2
 - https: limit proxy CONNECT response headers
 - Update https.js
Committers 1
 - Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/64545
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/64545
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Thu, 16 Jul 2026 19:36:16 GMT
   ✔  Approvals: 3
   ✔  - Tim Perry (@pimterry): https://github.com/nodejs/node/pull/64545#pullrequestreview-4722448442
   ✔  - James M Snell (@jasnell) (TSC): https://github.com/nodejs/node/pull/64545#pullrequestreview-4731343539
   ✔  - Joyee Cheung (@joyeecheung) (TSC): https://github.com/nodejs/node/pull/64545#pullrequestreview-4877655248
   ✘  GitHub CI is still running
   ℹ  Last Full PR CI on 2026-09-02T05:27:18Z: https://ci.nodejs.org/job/node-test-pull-request/76870/
- Querying data for job/node-test-pull-request/76870/
✔  Build data downloaded
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  Aborted `git node land` session in /home/runner/work/node/node/.ncu

View workflow run