Skip to content

fix: convert parseUnparsedAttributes recursion to iteration to prevent stack overflow on malformed Set-Cookie headers - #5651

Open
mcollina wants to merge 1 commit into
mainfrom
advisory-fix-1
Open

fix: convert parseUnparsedAttributes recursion to iteration to prevent stack overflow on malformed Set-Cookie headers#5651
mcollina wants to merge 1 commit into
mainfrom
advisory-fix-1

Conversation

@mcollina

@mcollina mcollina commented Aug 4, 2026

Copy link
Copy Markdown
Member

Replace recursive processing of Set-Cookie attributes with iteration. This preserves the existing parsing behavior while avoiding call-stack growth for headers with many attributes.

…t stack overflow on malformed Set-Cookie headers
@codecov-commenter

codecov-commenter commented Aug 4, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 96.41026% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.43%. Comparing base (c8d80e6) to head (7e5edf1).

Files with missing lines Patch % Lines
lib/web/cookies/parse.js 96.41% 7 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #5651      +/-   ##
==========================================
+ Coverage   93.42%   93.43%   +0.01%     
==========================================
  Files         110      110              
  Lines       38710    38705       -5     
==========================================
  Hits        36165    36165              
+ Misses       2545     2540       -5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants