diff --git a/lib/internal/http2/core.js b/lib/internal/http2/core.js index 01a8a823adac08..6232df7f549a28 100644 --- a/lib/internal/http2/core.js +++ b/lib/internal/http2/core.js @@ -162,6 +162,7 @@ function debugSessionObj(session, message, ...args) { const kMaxFrameSize = (2 ** 24) - 1; const kMaxInt = (2 ** 32) - 1; const kMaxStreams = (2 ** 31) - 1; +const kMaxALTSVC = (2 ** 14) - 2; // eslint-disable-next-line no-control-regex const kQuotedString = /^[\x09\x20-\x5b\x5d-\x7e\x80-\xff]*$/; @@ -1498,7 +1499,7 @@ class ServerHttp2Session extends Http2Session { throw new ERR_INVALID_CHAR('alt'); // Max length permitted for ALTSVC - if ((alt.length + (origin !== undefined ? origin.length : 0)) > 16382) + if ((alt.length + (origin !== undefined ? origin.length : 0)) > kMaxALTSVC) throw new ERR_HTTP2_ALTSVC_LENGTH(); this[kHandle].altsvc(stream, origin || '', alt); @@ -1530,7 +1531,7 @@ class ServerHttp2Session extends Http2Session { len += origin.length; } - if (len > 16382) + if (len > kMaxALTSVC) throw new ERR_HTTP2_ORIGIN_LENGTH(); this[kHandle].origin(arr, count);