deps,http: llhttp set max header size to 8KB

CVE-2018-12121 As per nodejs-private/node-private#149 for http_parse but for llhttp Ref: nodejs-private/node-private#143 PR-URL: nodejs-private/node-private#149 Reviewed-By: Matteo Collina <[email protected]>
nodejs · Nov 27, 2018 · a2b8aba · a2b8aba
1 parent 74e01d0
commit a2b8aba
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/node_http_parser.cc b/src/node_http_parser.cc
@@ -852,7 +852,7 @@ class Parser : public AsyncWrap, public StreamListener {
 
   static const parser_settings_t settings;
 #ifdef NODE_EXPERIMENTAL_HTTP
-  static const uint64_t kMaxHeaderSize = 80 * 1024;
+  static const uint64_t kMaxHeaderSize = 8 * 1024;
 #endif  /* NODE_EXPERIMENTAL_HTTP */
 };