Skip to content

Backport WebSocket maxPayloadSize fixes to v7.x#5423

Merged
mcollina merged 4 commits into
v7.xfrom
backport/websocket-max-payload-size-v7
Jun 15, 2026
Merged

Backport WebSocket maxPayloadSize fixes to v7.x#5423
mcollina merged 4 commits into
v7.xfrom
backport/websocket-max-payload-size-v7

Conversation

@mcollina

@mcollina mcollina commented Jun 13, 2026

Copy link
Copy Markdown
Member

This relates to...

Backporting WebSocket maxPayloadSize support and follow-up fixes from main to v7.x.

Backported commits:

Related main commit 32dbf0b3 is not included because v7.x already contains the equivalent fragment-limit backport as 8cb10f98.

Rationale

Keeps the v7 release line aligned with main for configurable WebSocket payload limits, including enforcement across fragmented messages and WebSocketStream parser limits.

Changes

Features

  • Adds dispatcher webSocket.maxPayloadSize support with a 128 MB default and 0 to disable.
  • Documents and types the new option.
  • Preserves the existing v7 webSocket.maxFragments option while integrating the new payload limit.

Bug Fixes

  • Rejects oversized WebSocket payloads across uncompressed, compressed, and fragmented message paths.
  • Applies dispatcher WebSocket limits to WebSocketStream's parser.
  • Counts empty fragments toward maxFragments.
  • Includes the follow-up flaky-test timeout fix from main.

Breaking Changes and Deprecations

N/A

Status

Tests:

  • npm run test:typescript
  • node --test test/websocket/fragments.js test/websocket/stream/too-many-fragments.js test/websocket/permessage-deflate-limit.js test/websocket/permessage-deflate-config.js
  • npm run lint

@codecov-commenter

codecov-commenter commented Jun 13, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.10%. Comparing base (8cb10f9) to head (f49f6fa).

Additional details and impacted files
@@            Coverage Diff             @@
##             v7.x    #5423      +/-   ##
==========================================
+ Coverage   93.01%   93.10%   +0.08%     
==========================================
  Files         112      112              
  Lines       35983    36018      +35     
==========================================
+ Hits        33471    33535      +64     
+ Misses       2512     2483      -29     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@mcollina mcollina force-pushed the backport/websocket-max-payload-size-v7 branch from a708dc8 to a6824f7 Compare June 13, 2026 14:51
mcollina and others added 3 commits June 15, 2026 09:02
(cherry picked from commit bd91f86)
Signed-off-by: Matteo Collina <hello@matteocollina.com>
(cherry picked from commit 9d82667)
Signed-off-by: Matteo Collina <hello@matteocollina.com>
Account for previously received fragment bytes when checking WebSocket payload size limits, so fragmented messages cannot exceed maxPayloadSize by splitting the payload across frames.

Add coverage for cumulative fragmented payload size enforcement.

Co-authored-by: Matthew Aitken <maitken033380023@gmail.com>
(cherry picked from commit b4c287b)
Signed-off-by: Matteo Collina <hello@matteocollina.com>
@mcollina mcollina force-pushed the backport/websocket-max-payload-size-v7 branch from a6824f7 to b4eb7db Compare June 15, 2026 07:15
Treat zero-byte frames as real fragments so fragmented messages can start
with an empty frame and empty continuations still count toward
maxFragments.

Pass dispatcher WebSocket limits through to WebSocketStream's parser, add
regression coverage for WebSocket and WebSocketStream fragment limits, make
the fragment close tests wait for both endpoints, and fix the Client docs
typo for maxFragments.

Co-authored-by: Ulises Gascon <ulisesgascongonzalez@gmail.com>
(cherry picked from commit c5ed787)
Signed-off-by: Matteo Collina <hello@matteocollina.com>
@mcollina mcollina merged commit a027a4a into v7.x Jun 15, 2026
69 of 71 checks passed
@mcollina mcollina deleted the backport/websocket-max-payload-size-v7 branch June 15, 2026 09:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants