<story><title>Node v0.10.21 Stable has critical security fix</title><url>http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/</url><text></text></story><parent_chain></parent_chain><comment><author>meritt</author><text>HTTP Pipelining is designed so a client can send multiple requests without waiting on a response and then the server sends all the responses in order. This is helpful on high latency links since it can combine numerous HTTP requests into fewer packets. The exploit is the client never stops to read and just writes requests nonstop. Meanwhile node&amp;#x27;s http.Server continually populates a response buffer which is never consumed.&lt;p&gt;Node uses Stream[1] objects for reading&amp;#x2F;writing streams of data. The Stream object has a &amp;#x27;needsDrain&amp;#x27; boolean which is set once its internal buffer surpasses the highWaterMark (defaults to 16kb). Subsequent writes will return false[2] and code should wait until the &amp;#x27;drain&amp;#x27; event is emitted, signaling it&amp;#x27;s safe to write again[3]. The documentation even warns about this scenario:&lt;p&gt;&amp;gt; &lt;i&gt;However, writes will be buffered in memory, so it is best not to do this excessively. Instead, wait for the drain event before writing more data.&lt;/i&gt;&lt;p&gt;http.Server[4] uses a writeable stream to send responses to a client. Until this patch[5] it was ignoring the needsDrain&amp;#x2F;highWaterMark status and just writing to the stream. It fills up the buffer of the writeable stream, far beyond the high water mark and eventually runs out of memory.&lt;p&gt;The patch resolves this by checking when needsDrain is set, then it stops writing and stops reading&amp;#x2F;parsing incoming data. It then waits until the &amp;#x27;drain&amp;#x27; event is fired and then proceeds as normal.&lt;p&gt;[1] &lt;a href=&quot;http://nodejs.org/api/stream.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;nodejs.org&amp;#x2F;api&amp;#x2F;stream.html&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;http://nodejs.org/api/stream.html#stream_writable_write_chunk_encoding_callback&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;nodejs.org&amp;#x2F;api&amp;#x2F;stream.html#stream_writable_write_chun...&lt;/a&gt;&lt;p&gt;[3] &lt;a href=&quot;http://nodejs.org/api/stream.html#stream_event_drain&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;nodejs.org&amp;#x2F;api&amp;#x2F;stream.html#stream_event_drain&lt;/a&gt;&lt;p&gt;[4] &lt;a href=&quot;http://nodejs.org/api/http.html#http_class_http_server&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;nodejs.org&amp;#x2F;api&amp;#x2F;http.html#http_class_http_server&lt;/a&gt;&lt;p&gt;[5] &lt;a href=&quot;https://github.com/joyent/node/commit/085dd30e93da67362f044ad1b3b6b2d997064692&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;joyent&amp;#x2F;node&amp;#x2F;commit&amp;#x2F;085dd30e93da67362f044a...&lt;/a&gt;</text></comment>
<story><title>Node v0.10.21 Stable has critical security fix</title><url>http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/</url><text></text></story><parent_chain></parent_chain><comment><author>jared314</author><text>Apparently, a trivial DoS vulnerability for any Node serving HTTP:&lt;p&gt;&lt;a href=&quot;https://groups.google.com/forum/#!msg/nodejs/NEbweYB0ei0/gWvyzCunYjsJ&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;groups.google.com&amp;#x2F;forum&amp;#x2F;#!msg&amp;#x2F;nodejs&amp;#x2F;NEbweYB0ei0&amp;#x2F;gWv...&lt;/a&gt;&lt;p&gt;The odd thing about non-disclosure in an open source project is: I can diff the code bases before and after the fix.&lt;p&gt;&lt;a href=&quot;https://github.com/joyent/node/issues/6214&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;joyent&amp;#x2F;node&amp;#x2F;issues&amp;#x2F;6214&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https://github.com/joyent/node/commit/085dd30e93da67362f044ad1b3b6b2d997064692&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;joyent&amp;#x2F;node&amp;#x2F;commit&amp;#x2F;085dd30e93da67362f044a...&lt;/a&gt;&lt;p&gt;And, they have a test script:&lt;p&gt;&lt;a href=&quot;https://github.com/joyent/node/blob/085dd30e93da67362f044ad1b3b6b2d997064692/test/simple/test-http-pipeline-flood.js&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;joyent&amp;#x2F;node&amp;#x2F;blob&amp;#x2F;085dd30e93da67362f044ad1...&lt;/a&gt;</text></comment>