René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"HTTP2 server memory explodes and terminated","articleBody":"### Version\n\n20.13.0 and later, including latest 22.x\n\n### Platform\n\nLinux hostname 6.5.0-28-generic #29~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr  4 14:39:20 UTC 2 x86_64 x86_64 x86_64 GNU/Linux\n\n### Subsystem\n\n_No response_\n\n### What steps will reproduce the bug?\n\nI may need some help to narrow down the problem as it happens sporadically.\r\n\r\nCurrently I only know that it happens after:\r\n\r\n1. A session created.\r\n2. The server `pushStream` to the client (and callback called).\r\n3. The client sends a request to create another stream and the server hangs.\r\n\r\nI have tested with versions 20.10.0, 20.11.0, 20.12.0 and 20.12.1 and there's no problem. But since 20.13.0 the issue appears.\n\n### How often does it reproduce? Is there a required condition?\n\n_No response_\n\n### What is the expected behavior? Why is that the expected behavior?\n\n_No response_\n\n### What do you see instead?\n\nI tried to use `--inspect` and pause on hanging (also the memory usage increases rapidly to several gigabytes and then terminated by OS I think) but no luck.\r\n\r\nAnd tried `--prof` there's part of that looks suspicious:\r\n\r\n```\r\n   ticks parent  name\r\n  27305   70.6%  /usr/bin/node\r\n  24662   90.3%    JS: ^submitRstStream node:internal/http2/core:450:25\r\n  24662  100.0%      JS: ^finishCloseStream node:internal/http2/core:1963:27\r\n  24662  100.0%        JS: ^closeStream node:internal/http2/core:1930:21\r\n  24662  100.0%          JS: ^_destroy node:internal/http2/core:2325:11\r\n  24662  100.0%            JS: ^_destroy node:internal/streams/destroy:90:18\r\n```\r\n\r\nI am not a security guy but at first I thought it's something related to HTTP2 rapid reset attack and spent a whole day debugging towards that. At the end of the day I decided to downgrade Node.js and found out the older version just works.\n\n### Additional information\n\nAlso the HTTP2 server is on internet but generally only used by myself. Though I do saw a Russian IP connecting it periodically and that's also why I thought it was an attack.\r\n\r\nBut it also happens with only my own clients connected.","author":{"url":"https://github.com/vilicvane","@type":"Person","name":"vilicvane"},"datePublished":"2024-05-12T04:27:30Z","url":"https://github.com/nodejs/node/issues/52952"}