From 3e14212f0e86bd5a8b5916d8a3acbbc0f42a1b1c Mon Sep 17 00:00:00 2001
From: Rich Trott <rtrott@gmail.com>
Date: Mon, 10 Dec 2018 12:11:47 -0800
Subject: [PATCH 01/10] test: remove magic numbers in
 test-gc-http-client-onerror

Remove magic numbers (500, 10, 100) from the test. Instead, detect when
GC has started and stop sending requests at that point.

On my laptop, this results in 16 or 20 requests per run instead of 500.

Fixes: https://github.com/nodejs/node/issues/23089

PR-URL: https://github.com/nodejs/node/pull/24943
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
---
 test/parallel/test-gc-http-client-onerror.js | 53 +++++++++++---------
 1 file changed, 30 insertions(+), 23 deletions(-)

diff --git a/test/parallel/test-gc-http-client-onerror.js b/test/parallel/test-gc-http-client-onerror.js
index 28a8aecd27e794..30b272ed94aae9 100644
--- a/test/parallel/test-gc-http-client-onerror.js
+++ b/test/parallel/test-gc-http-client-onerror.js
@@ -6,6 +6,8 @@
 const common = require('../common');
 const onGC = require('../common/ongc');
 
+const cpus = require('os').cpus().length;
+
 function serverHandler(req, res) {
   req.resume();
   res.writeHead(200, { 'Content-Type': 'text/plain' });
@@ -13,38 +15,35 @@ function serverHandler(req, res) {
 }
 
 const http = require('http');
-const todo = 500;
+let createClients = true;
 let done = 0;
 let count = 0;
 let countGC = 0;
 
-console.log(`We should do ${todo} requests`);
-
 const server = http.createServer(serverHandler);
 server.listen(0, common.mustCall(() => {
-  for (let i = 0; i < 10; i++)
-    getall();
+  for (let i = 0; i < cpus; i++)
+    getAll();
 }));
 
-function getall() {
-  if (count >= todo)
-    return;
-
-  const req = http.get({
-    hostname: 'localhost',
-    pathname: '/',
-    port: server.address().port
-  }, cb).on('error', onerror);
+function getAll() {
+  if (createClients) {
+    const req = http.get({
+      hostname: 'localhost',
+      pathname: '/',
+      port: server.address().port
+    }, cb).on('error', onerror);
 
-  count++;
-  onGC(req, { ongc });
+    count++;
+    onGC(req, { ongc });
 
-  setImmediate(getall);
+    setImmediate(getAll);
+  }
 }
 
 function cb(res) {
   res.resume();
-  done += 1;
+  done++;
 }
 
 function onerror(err) {
@@ -55,11 +54,19 @@ function ongc() {
   countGC++;
 }
 
-setInterval(status, 100).unref();
+setImmediate(status);
 
 function status() {
-  global.gc();
-  console.log('Done: %d/%d', done, todo);
-  console.log('Collected: %d/%d', countGC, count);
-  if (countGC === todo) server.close();
+  if (done > 0) {
+    createClients = false;
+    global.gc();
+    console.log(`done/collected/total: ${done}/${countGC}/${count}`);
+    if (countGC === count) {
+      server.close();
+    } else {
+      setImmediate(status);
+    }
+  } else {
+    setImmediate(status);
+  }
 }

From 527407c49fe37599a6d8daec70d2ff1e30d2a4f8 Mon Sep 17 00:00:00 2001
From: Joyee Cheung <joyeec9h3@gmail.com>
Date: Mon, 5 Nov 2018 04:52:50 +0800
Subject: [PATCH 02/10] src: cache the result of GetOptions() in JS land

Instead of calling into C++ each time we need to check the value
of a command line option, cache the option map in a new
`internal/options` module for faster access to the values in JS land.

PR-URL: https://github.com/nodejs/node/pull/24091
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Refael Ackermann <refack@gmail.com>
---
 lib/crypto.js                               |  2 +-
 lib/internal/bash_completion.js             |  3 +--
 lib/internal/bootstrap/loaders.js           |  3 +--
 lib/internal/bootstrap/node.js              | 16 ++++++++--------
 lib/internal/modules/cjs/helpers.js         |  4 ++--
 lib/internal/modules/cjs/loader.js          |  8 ++++----
 lib/internal/modules/esm/default_resolve.js |  6 +++---
 lib/internal/options.js                     | 18 ++++++++++++++++++
 lib/internal/print_help.js                  |  5 +++--
 lib/internal/process/esm_loader.js          |  2 +-
 lib/repl.js                                 |  2 +-
 lib/vm.js                                   |  2 +-
 node.gyp                                    |  1 +
 src/node_options.cc                         | 17 ++---------------
 14 files changed, 47 insertions(+), 42 deletions(-)
 create mode 100644 lib/internal/options.js

diff --git a/lib/crypto.js b/lib/crypto.js
index f23f1f9ae749e6..9ab08ab4b2a568 100644
--- a/lib/crypto.js
+++ b/lib/crypto.js
@@ -34,7 +34,7 @@ const {
   ERR_CRYPTO_FIPS_FORCED,
   ERR_CRYPTO_FIPS_UNAVAILABLE
 } = require('internal/errors').codes;
-const constants = process.binding('constants').crypto;
+const constants = internalBinding('constants').crypto;
 const {
   fipsMode,
   fipsForced
diff --git a/lib/internal/bash_completion.js b/lib/internal/bash_completion.js
index cb8eab9ceec855..13363e8c4b8c32 100644
--- a/lib/internal/bash_completion.js
+++ b/lib/internal/bash_completion.js
@@ -1,8 +1,7 @@
 'use strict';
-const { getOptions } = internalBinding('options');
+const { options, aliases } = require('internal/options');
 
 function print(stream) {
-  const { options, aliases } = getOptions();
   const all_opts = [...options.keys(), ...aliases.keys()];
 
   stream.write(`_node_complete() {
diff --git a/lib/internal/bootstrap/loaders.js b/lib/internal/bootstrap/loaders.js
index a90da4861b7b79..e2cfdbf83d38ef 100644
--- a/lib/internal/bootstrap/loaders.js
+++ b/lib/internal/bootstrap/loaders.js
@@ -217,8 +217,7 @@
 
     NativeModule.isInternal = function(id) {
       return id.startsWith('internal/') ||
-          (id === 'worker_threads' &&
-           !internalBinding('options').getOptions('--experimental-worker'));
+          (id === 'worker_threads' && !config.experimentalWorker);
     };
   }
 
diff --git a/lib/internal/bootstrap/node.js b/lib/internal/bootstrap/node.js
index 067998f115ccc9..0ac0559000732b 100644
--- a/lib/internal/bootstrap/node.js
+++ b/lib/internal/bootstrap/node.js
@@ -113,12 +113,13 @@
       NativeModule.require('internal/inspector_async_hook').setup();
     }
 
-    const { getOptions } = internalBinding('options');
-    const helpOption = getOptions('--help');
-    const completionBashOption = getOptions('--completion-bash');
-    const experimentalModulesOption = getOptions('--experimental-modules');
-    const experimentalVMModulesOption = getOptions('--experimental-vm-modules');
-    const experimentalWorkerOption = getOptions('--experimental-worker');
+    const { getOptionValue } = NativeModule.require('internal/options');
+    const helpOption = getOptionValue('--help');
+    const completionBashOption = getOptionValue('--completion-bash');
+    const experimentalModulesOption = getOptionValue('--experimental-modules');
+    const experimentalVMModulesOption =
+      getOptionValue('--experimental-vm-modules');
+    const experimentalWorkerOption = getOptionValue('--experimental-worker');
     if (helpOption) {
       NativeModule.require('internal/print_help').print(process.stdout);
       return;
@@ -631,10 +632,9 @@
 
     const get = () => {
       const {
-        getOptions,
         envSettings: { kAllowedInEnvironment }
       } = internalBinding('options');
-      const { options, aliases } = getOptions();
+      const { options, aliases } = NativeModule.require('internal/options');
 
       const allowedNodeEnvironmentFlags = [];
       for (const [name, info] of options) {
diff --git a/lib/internal/modules/cjs/helpers.js b/lib/internal/modules/cjs/helpers.js
index cda94987fad210..b08e97b29c5c8d 100644
--- a/lib/internal/modules/cjs/helpers.js
+++ b/lib/internal/modules/cjs/helpers.js
@@ -9,7 +9,7 @@ const {
   CHAR_HASH,
 } = require('internal/constants');
 
-const { getOptions } = internalBinding('options');
+const { getOptionValue } = require('internal/options');
 
 // Invoke with makeRequireFunction(module) where |module| is the Module object
 // to use as the context for the require() function.
@@ -107,7 +107,7 @@ const builtinLibs = [
   'v8', 'vm', 'zlib'
 ];
 
-if (getOptions('--experimental-worker')) {
+if (getOptionValue('--experimental-worker')) {
   builtinLibs.push('worker_threads');
   builtinLibs.sort();
 }
diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js
index 4e48d549377081..fb3770b7299d4e 100644
--- a/lib/internal/modules/cjs/loader.js
+++ b/lib/internal/modules/cjs/loader.js
@@ -40,10 +40,10 @@ const {
   stripBOM,
   stripShebang
 } = require('internal/modules/cjs/helpers');
-const options = internalBinding('options');
-const preserveSymlinks = options.getOptions('--preserve-symlinks');
-const preserveSymlinksMain = options.getOptions('--preserve-symlinks-main');
-const experimentalModules = options.getOptions('--experimental-modules');
+const { getOptionValue } = require('internal/options');
+const preserveSymlinks = getOptionValue('--preserve-symlinks');
+const preserveSymlinksMain = getOptionValue('--preserve-symlinks-main');
+const experimentalModules = getOptionValue('--experimental-modules');
 
 const {
   ERR_INVALID_ARG_TYPE,
diff --git a/lib/internal/modules/esm/default_resolve.js b/lib/internal/modules/esm/default_resolve.js
index 7654ca91129325..9aa54d09a1b07c 100644
--- a/lib/internal/modules/esm/default_resolve.js
+++ b/lib/internal/modules/esm/default_resolve.js
@@ -6,9 +6,9 @@ const internalFS = require('internal/fs/utils');
 const { NativeModule } = require('internal/bootstrap/loaders');
 const { extname } = require('path');
 const { realpathSync } = require('fs');
-const { getOptions } = internalBinding('options');
-const preserveSymlinks = getOptions('--preserve-symlinks');
-const preserveSymlinksMain = getOptions('--preserve-symlinks-main');
+const { getOptionValue } = require('internal/options');
+const preserveSymlinks = getOptionValue('--preserve-symlinks');
+const preserveSymlinksMain = getOptionValue('--preserve-symlinks-main');
 const {
   ERR_MISSING_MODULE,
   ERR_MODULE_RESOLUTION_LEGACY,
diff --git a/lib/internal/options.js b/lib/internal/options.js
new file mode 100644
index 00000000000000..e494787b96c088
--- /dev/null
+++ b/lib/internal/options.js
@@ -0,0 +1,18 @@
+'use strict';
+
+const { getOptions } = internalBinding('options');
+const { options, aliases } = getOptions();
+
+function getOptionValue(option) {
+  const result = options.get(option);
+  if (!result) {
+    return undefined;
+  }
+  return result.value;
+}
+
+module.exports = {
+  options,
+  aliases,
+  getOptionValue
+};
diff --git a/lib/internal/print_help.js b/lib/internal/print_help.js
index 8acc9271b19188..d9ab3c1ad84e90 100644
--- a/lib/internal/print_help.js
+++ b/lib/internal/print_help.js
@@ -1,5 +1,6 @@
 'use strict';
-const { getOptions, types } = internalBinding('options');
+
+const { types } = internalBinding('options');
 
 const typeLookup = [];
 for (const key of Object.keys(types))
@@ -132,7 +133,7 @@ function format({ options, aliases = new Map(), firstColumn, secondColumn }) {
 }
 
 function print(stream) {
-  const { options, aliases } = getOptions();
+  const { options, aliases } = require('internal/options');
 
   // Use 75 % of the available width, and at least 70 characters.
   const width = Math.max(70, (stream.columns || 0) * 0.75);
diff --git a/lib/internal/process/esm_loader.js b/lib/internal/process/esm_loader.js
index d775e685d13ea7..be08a6364781ed 100644
--- a/lib/internal/process/esm_loader.js
+++ b/lib/internal/process/esm_loader.js
@@ -48,7 +48,7 @@ exports.setup = function() {
 
   let ESMLoader = new Loader();
   const loaderPromise = (async () => {
-    const userLoader = internalBinding('options').getOptions('--loader');
+    const userLoader = require('internal/options').getOptionValue('--loader');
     if (userLoader) {
       const hooks = await ESMLoader.import(
         userLoader, pathToFileURL(`${process.cwd()}/`).href);
diff --git a/lib/repl.js b/lib/repl.js
index b00bca41cbda8c..448308a44c007a 100644
--- a/lib/repl.js
+++ b/lib/repl.js
@@ -71,7 +71,7 @@ const {
   ERR_SCRIPT_EXECUTION_INTERRUPTED
 } = require('internal/errors').codes;
 const { sendInspectorCommand } = require('internal/util/inspector');
-const experimentalREPLAwait = internalBinding('options').getOptions(
+const experimentalREPLAwait = require('internal/options').getOptionValue(
   '--experimental-repl-await'
 );
 const { isRecoverableError } = require('internal/repl/recoverable');
diff --git a/lib/vm.js b/lib/vm.js
index 720d46ea1abdcd..dbe48b7b15c194 100644
--- a/lib/vm.js
+++ b/lib/vm.js
@@ -402,7 +402,7 @@ module.exports = {
   compileFunction,
 };
 
-if (internalBinding('options').getOptions('--experimental-vm-modules')) {
+if (require('internal/options').getOptionValue('--experimental-vm-modules')) {
   const { SourceTextModule } = require('internal/vm/source_text_module');
   module.exports.SourceTextModule = SourceTextModule;
 }
diff --git a/node.gyp b/node.gyp
index f59b071b1ebba6..55f028636fd266 100644
--- a/node.gyp
+++ b/node.gyp
@@ -134,6 +134,7 @@
       'lib/internal/modules/esm/translators.js',
       'lib/internal/safe_globals.js',
       'lib/internal/net.js',
+      'lib/internal/options.js',
       'lib/internal/print_help.js',
       'lib/internal/process/esm_loader.js',
       'lib/internal/process/main_thread_only.js',
diff --git a/src/node_options.cc b/src/node_options.cc
index 2b95b3f811b4e7..ec819538d62977 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -367,9 +367,8 @@ HostPort SplitHostPort(const std::string& arg,
                     ParseAndValidatePort(arg.substr(colon + 1), errors) };
 }
 
-// Usage: Either:
-// - getOptions() to get all options + metadata or
-// - getOptions(string) to get the value of a particular option
+// Return a map containing all the options and their metadata as well
+// as the aliases
 void GetOptions(const FunctionCallbackInfo<Value>& args) {
   Mutex::ScopedLock lock(per_process_opts_mutex);
   Environment* env = Environment::GetCurrent(args);
@@ -390,13 +389,8 @@ void GetOptions(const FunctionCallbackInfo<Value>& args) {
 
   const auto& parser = PerProcessOptionsParser::instance;
 
-  std::string filter;
-  if (args[0]->IsString()) filter = *node::Utf8Value(isolate, args[0]);
-
   Local<Map> options = Map::New(isolate);
   for (const auto& item : parser.options_) {
-    if (!filter.empty() && item.first != filter) continue;
-
     Local<Value> value;
     const auto& option_info = item.second;
     auto field = option_info.field;
@@ -445,11 +439,6 @@ void GetOptions(const FunctionCallbackInfo<Value>& args) {
     }
     CHECK(!value.IsEmpty());
 
-    if (!filter.empty()) {
-      args.GetReturnValue().Set(value);
-      return;
-    }
-
     Local<Value> name = ToV8Value(context, item.first).ToLocalChecked();
     Local<Object> info = Object::New(isolate);
     Local<Value> help_text;
@@ -471,8 +460,6 @@ void GetOptions(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
-  if (!filter.empty()) return;
-
   Local<Value> aliases;
   if (!ToV8Value(context, parser.aliases_).ToLocal(&aliases)) return;
 

From 728bc631e512e0cb325a071ee83c8384c75661ff Mon Sep 17 00:00:00 2001
From: Ali Ijaz Sheikh <ofrobots@google.com>
Date: Tue, 18 Dec 2018 11:04:03 -0800
Subject: [PATCH 03/10] test: fix expectation in test-bootstrap-modules

PR-URL: https://github.com/nodejs/node/pull/25112
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
---
 test/parallel/test-bootstrap-modules.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/test/parallel/test-bootstrap-modules.js b/test/parallel/test-bootstrap-modules.js
index 70011637e08af4..a047d50b57e2b6 100644
--- a/test/parallel/test-bootstrap-modules.js
+++ b/test/parallel/test-bootstrap-modules.js
@@ -11,4 +11,5 @@ const list = process.moduleLoadList.slice();
 
 const assert = require('assert');
 
-assert(list.length <= 78, list);
+assert(list.length <= 81,
+       `Expected <= 81 elements in moduleLoadLists, got ${list.length}`);

From 1aea1e3634de7331f670f0594c023ca7c64a759f Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Fri, 14 Dec 2018 12:44:39 +0100
Subject: [PATCH 04/10] http: fix regression of binary upgrade response body

PR-URL: https://github.com/nodejs/node/pull/25039
Fixes: https://github.com/nodejs/node/issues/24958
Reviewed-By: Myles Borins <myles.borins@gmail.com>
---
 src/node_http_parser.cc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/node_http_parser.cc b/src/node_http_parser.cc
index 5ad8afbdbf76b2..58bae3323c0484 100644
--- a/src/node_http_parser.cc
+++ b/src/node_http_parser.cc
@@ -605,8 +605,6 @@ class Parser : public AsyncWrap, public StreamListener {
     size_t nparsed =
       http_parser_execute(&parser_, &settings, data, len);
 
-    enum http_errno err = HTTP_PARSER_ERRNO(&parser_);
-
     Save();
 
     // Unassign the 'buffer_' variable
@@ -621,7 +619,9 @@ class Parser : public AsyncWrap, public StreamListener {
     Local<Integer> nparsed_obj = Integer::New(env()->isolate(), nparsed);
     // If there was a parse error in one of the callbacks
     // TODO(bnoordhuis) What if there is an error on EOF?
-    if ((!parser_.upgrade && nparsed != len) || err != HPE_OK) {
+    if (!parser_.upgrade && nparsed != len) {
+      enum http_errno err = HTTP_PARSER_ERRNO(&parser_);
+
       Local<Value> e = Exception::Error(env()->parse_error_string());
       Local<Object> obj = e->ToObject(env()->isolate()->GetCurrentContext())
         .ToLocalChecked();

From 6183c7107de539a2169ddd4bfe283026d986dd36 Mon Sep 17 00:00:00 2001
From: cjihrig <cjihrig@gmail.com>
Date: Thu, 29 Nov 2018 17:29:53 -0500
Subject: [PATCH 05/10] deps: cherry-pick http_parser_set_max_header_size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit adds http_parser_set_max_header_size() to the
http-parser for overriding the compile time maximum HTTP
header size.

Backport-PR-URL: https://github.com/nodejs/node/pull/25168
PR-URL: https://github.com/nodejs/node/pull/24811
Fixes: https://github.com/nodejs/node/issues/24692
Refs: https://github.com/nodejs/http-parser/pull/453
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
---
 deps/http_parser/http_parser.c | 15 +++++++++++----
 deps/http_parser/http_parser.h |  3 +++
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/deps/http_parser/http_parser.c b/deps/http_parser/http_parser.c
index 6522618671d09c..46764bced09478 100644
--- a/deps/http_parser/http_parser.c
+++ b/deps/http_parser/http_parser.c
@@ -25,6 +25,8 @@
 #include <string.h>
 #include <limits.h>
 
+static uint32_t max_header_size = HTTP_MAX_HEADER_SIZE;
+
 #ifndef ULLONG_MAX
 # define ULLONG_MAX ((uint64_t) -1) /* 2^64-1 */
 #endif
@@ -137,20 +139,20 @@ do {                                                                 \
 } while (0)
 
 /* Don't allow the total size of the HTTP headers (including the status
- * line) to exceed HTTP_MAX_HEADER_SIZE.  This check is here to protect
+ * line) to exceed max_header_size.  This check is here to protect
  * embedders against denial-of-service attacks where the attacker feeds
  * us a never-ending header that the embedder keeps buffering.
  *
  * This check is arguably the responsibility of embedders but we're doing
  * it on the embedder's behalf because most won't bother and this way we
- * make the web a little safer.  HTTP_MAX_HEADER_SIZE is still far bigger
+ * make the web a little safer.  max_header_size is still far bigger
  * than any reasonable request or response so this should never affect
  * day-to-day operation.
  */
 #define COUNT_HEADER_SIZE(V)                                         \
 do {                                                                 \
   parser->nread += (V);                                              \
-  if (UNLIKELY(parser->nread > (HTTP_MAX_HEADER_SIZE))) {            \
+  if (UNLIKELY(parser->nread > max_header_size)) {                   \
     SET_ERRNO(HPE_HEADER_OVERFLOW);                                  \
     goto error;                                                      \
   }                                                                  \
@@ -1471,7 +1473,7 @@ size_t http_parser_execute (http_parser *parser,
               const char* p_lf;
               size_t limit = data + len - p;
 
-              limit = MIN(limit, HTTP_MAX_HEADER_SIZE);
+              limit = MIN(limit, max_header_size);
 
               p_cr = (const char*) memchr(p, CR, limit);
               p_lf = (const char*) memchr(p, LF, limit);
@@ -2437,3 +2439,8 @@ http_parser_version(void) {
          HTTP_PARSER_VERSION_MINOR * 0x00100 |
          HTTP_PARSER_VERSION_PATCH * 0x00001;
 }
+
+void
+http_parser_set_max_header_size(uint32_t size) {
+  max_header_size = size;
+}
diff --git a/deps/http_parser/http_parser.h b/deps/http_parser/http_parser.h
index 1fbf30e2b4740b..ea7bafef2c3178 100644
--- a/deps/http_parser/http_parser.h
+++ b/deps/http_parser/http_parser.h
@@ -427,6 +427,9 @@ void http_parser_pause(http_parser *parser, int paused);
 /* Checks if this is the final chunk of the body. */
 int http_body_is_final(const http_parser *parser);
 
+/* Change the maximum header size provided at compile time. */
+void http_parser_set_max_header_size(uint32_t size);
+
 #ifdef __cplusplus
 }
 #endif

From a57aed144a60b5ee0c73b969f5b9ffc71fd93296 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Tue, 18 Dec 2018 12:12:21 +0100
Subject: [PATCH 06/10] src: add kUInteger parsing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit adds support for uint64_t option parsing.

Backport-PR-URL: https://github.com/nodejs/node/pull/25168
PR-URL: https://github.com/nodejs/node/pull/24811
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
---
 lib/internal/print_help.js |  1 +
 src/node_options-inl.h     | 16 ++++++++++++++++
 src/node_options.cc        |  4 ++++
 src/node_options.h         |  5 +++++
 4 files changed, 26 insertions(+)

diff --git a/lib/internal/print_help.js b/lib/internal/print_help.js
index d9ab3c1ad84e90..c453562c5c40bf 100644
--- a/lib/internal/print_help.js
+++ b/lib/internal/print_help.js
@@ -59,6 +59,7 @@ function getArgDescription(type) {
     case 'kHostPort':
       return '[host:]port';
     case 'kInteger':
+    case 'kUInteger':
     case 'kString':
     case 'kStringList':
       return '...';
diff --git a/src/node_options-inl.h b/src/node_options-inl.h
index 277121036e519d..69b8ee0e787747 100644
--- a/src/node_options-inl.h
+++ b/src/node_options-inl.h
@@ -35,6 +35,19 @@ void OptionsParser<Options>::AddOption(const std::string& name,
                               help_text});
 }
 
+template <typename Options>
+void OptionsParser<Options>::AddOption(const std::string& name,
+                                       const std::string& help_text,
+                                       uint64_t Options::* field,
+                                       OptionEnvvarSettings env_setting) {
+  options_.emplace(
+      name,
+      OptionInfo{kUInteger,
+                 std::make_shared<SimpleOptionField<uint64_t>>(field),
+                 env_setting,
+                 help_text});
+}
+
 template <typename Options>
 void OptionsParser<Options>::AddOption(const std::string& name,
                                        const std::string& help_text,
@@ -397,6 +410,9 @@ void OptionsParser<Options>::Parse(
       case kInteger:
         *Lookup<int64_t>(info.field, options) = std::atoll(value.c_str());
         break;
+      case kUInteger:
+        *Lookup<uint64_t>(info.field, options) = std::stoull(value.c_str());
+        break;
       case kString:
         *Lookup<std::string>(info.field, options) = value;
         break;
diff --git a/src/node_options.cc b/src/node_options.cc
index ec819538d62977..1c63fa286f0f89 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -406,6 +406,9 @@ void GetOptions(const FunctionCallbackInfo<Value>& args) {
       case kInteger:
         value = Number::New(isolate, *parser.Lookup<int64_t>(field, opts));
         break;
+      case kUInteger:
+        value = Number::New(isolate, *parser.Lookup<uint64_t>(field, opts));
+        break;
       case kString:
         if (!ToV8Value(context, *parser.Lookup<std::string>(field, opts))
                  .ToLocal(&value)) {
@@ -492,6 +495,7 @@ void Initialize(Local<Object> target,
   NODE_DEFINE_CONSTANT(types, kV8Option);
   NODE_DEFINE_CONSTANT(types, kBoolean);
   NODE_DEFINE_CONSTANT(types, kInteger);
+  NODE_DEFINE_CONSTANT(types, kUInteger);
   NODE_DEFINE_CONSTANT(types, kString);
   NODE_DEFINE_CONSTANT(types, kHostPort);
   NODE_DEFINE_CONSTANT(types, kStringList);
diff --git a/src/node_options.h b/src/node_options.h
index 8c71881e64311d..32e01760f859bf 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -168,6 +168,7 @@ enum OptionType {
   kV8Option,
   kBoolean,
   kInteger,
+  kUInteger,
   kString,
   kHostPort,
   kStringList,
@@ -194,6 +195,10 @@ class OptionsParser {
                  const std::string& help_text,
                  bool Options::* field,
                  OptionEnvvarSettings env_setting = kDisallowedInEnvironment);
+  void AddOption(const std::string& name,
+                 const std::string& help_text,
+                 uint64_t Options::* field,
+                 OptionEnvvarSettings env_setting = kDisallowedInEnvironment);
   void AddOption(const std::string& name,
                  const std::string& help_text,
                  int64_t Options::* field,

From 9b2ffc81c0e4b29c0a8ace8b2a7526029f526a7e Mon Sep 17 00:00:00 2001
From: cjihrig <cjihrig@gmail.com>
Date: Mon, 3 Dec 2018 12:27:46 -0500
Subject: [PATCH 07/10] cli: add --max-http-header-size flag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allow the maximum size of HTTP headers to be overridden from
the command line.

Backport-PR-URL: https://github.com/nodejs/node/pull/25168
co-authored-by: Matteo Collina <hello@matteocollina.com>
PR-URL: https://github.com/nodejs/node/pull/24811
Fixes: https://github.com/nodejs/node/issues/24692
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
---
 doc/api/cli.md                                |   8 ++
 doc/node.1                                    |   3 +
 src/node_http_parser.cc                       |   7 ++
 src/node_options.cc                           |   4 +
 src/node_options.h                            |   1 +
 test/sequential/test-http-max-http-headers.js |  72 +++++++-----
 .../test-set-http-max-http-headers.js         | 104 ++++++++++++++++++
 7 files changed, 174 insertions(+), 25 deletions(-)
 create mode 100644 test/sequential/test-set-http-max-http-headers.js

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 29f3360dda1d78..d1fbf9432eb376 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -181,6 +181,13 @@ added: v9.0.0
 
 Specify the `file` of the custom [experimental ECMAScript Module][] loader.
 
+### `--max-http-header-size=size`
+<!-- YAML
+added: REPLACEME
+-->
+
+Specify the maximum size, in bytes, of HTTP headers. Defaults to 8KB.
+
 ### `--napi-modules`
 <!-- YAML
 added: v7.10.0
@@ -584,6 +591,7 @@ Node.js options that are allowed are:
 - `--inspect-brk`
 - `--inspect-port`
 - `--loader`
+- `--max-http-header-size`
 - `--napi-modules`
 - `--no-deprecation`
 - `--no-force-async-hooks-checks`
diff --git a/doc/node.1 b/doc/node.1
index b8144f4ebb5f6c..3d2344822df261 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -133,6 +133,9 @@ Specify the
 as a custom loader, to load
 .Fl -experimental-modules .
 .
+.It Fl -max-http-header-size Ns = Ns Ar size
+Specify the maximum size of HTTP headers in bytes. Defaults to 8KB.
+.
 .It Fl -napi-modules
 This option is a no-op.
 It is kept for compatibility.
diff --git a/src/node_http_parser.cc b/src/node_http_parser.cc
index 58bae3323c0484..4411b6b32f8e2b 100644
--- a/src/node_http_parser.cc
+++ b/src/node_http_parser.cc
@@ -738,6 +738,10 @@ const struct http_parser_settings Parser::settings = {
   nullptr   // on_chunk_complete
 };
 
+void InitMaxHttpHeaderSizeOnce() {
+  const uint32_t max_http_header_size = per_process_opts->max_http_header_size;
+  http_parser_set_max_header_size(max_http_header_size);
+}
 
 void Initialize(Local<Object> target,
                 Local<Value> unused,
@@ -784,6 +788,9 @@ void Initialize(Local<Object> target,
 
   target->Set(FIXED_ONE_BYTE_STRING(env->isolate(), "HTTPParser"),
               t->GetFunction(env->context()).ToLocalChecked());
+
+  static uv_once_t init_once = UV_ONCE_INIT;
+  uv_once(&init_once, InitMaxHttpHeaderSizeOnce);
 }
 
 }  // anonymous namespace
diff --git a/src/node_options.cc b/src/node_options.cc
index 1c63fa286f0f89..79dff7adbf9d63 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -236,6 +236,10 @@ PerProcessOptionsParser::PerProcessOptionsParser() {
             kAllowedInEnvironment);
   AddAlias("--trace-events-enabled", {
     "--trace-event-categories", "v8,node,node.async_hooks" });
+  AddOption("--max-http-header-size",
+            "set the maximum size of HTTP headers (default: 8KB)",
+            &PerProcessOptions::max_http_header_size,
+            kAllowedInEnvironment);
   AddOption("--v8-pool-size",
             "set V8's thread pool size",
             &PerProcessOptions::v8_thread_pool_size,
diff --git a/src/node_options.h b/src/node_options.h
index 32e01760f859bf..4edec114d6da1f 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -116,6 +116,7 @@ class PerProcessOptions : public Options {
   std::string title;
   std::string trace_event_categories;
   std::string trace_event_file_pattern = "node_trace.${rotation}.log";
+  uint64_t max_http_header_size = 8 * 1024;
   int64_t v8_thread_pool_size = 4;
   bool zero_fill_all_buffers = false;
 
diff --git a/test/sequential/test-http-max-http-headers.js b/test/sequential/test-http-max-http-headers.js
index ae76142a4fd077..507fcd388c1319 100644
--- a/test/sequential/test-http-max-http-headers.js
+++ b/test/sequential/test-http-max-http-headers.js
@@ -1,10 +1,15 @@
+// Flags: --expose-internals
 'use strict';
-
 const assert = require('assert');
 const common = require('../common');
 const http = require('http');
 const net = require('net');
-const MAX = 8 * 1024; // 8KB
+const MAX = +(process.argv[2] || 8 * 1024); // Command line option, or 8KB.
+
+const { getOptionValue } = require('internal/options');
+
+console.log('pid is', process.pid);
+console.log('max header size is', getOptionValue('--max-http-header-size'));
 
 // Verify that we cannot receive more than 8KB of headers.
 
@@ -28,19 +33,15 @@ function fillHeaders(headers, currentSize, valid = false) {
   headers += 'a'.repeat(MAX - headers.length - 3);
   // Generate valid headers
   if (valid) {
-    // TODO(mcollina): understand why -9 is needed instead of -1
-    headers = headers.slice(0, -9);
+    // TODO(mcollina): understand why -32 is needed instead of -1
+    headers = headers.slice(0, -32);
   }
   return headers + '\r\n\r\n';
 }
 
-const timeout = common.platformTimeout(10);
-
 function writeHeaders(socket, headers) {
   const array = [];
-
-  // this is off from 1024 so that \r\n does not get split
-  const chunkSize = 1000;
+  const chunkSize = 100;
   let last = 0;
 
   for (let i = 0; i < headers.length / chunkSize; i++) {
@@ -55,19 +56,25 @@ function writeHeaders(socket, headers) {
   next();
 
   function next() {
-    if (socket.write(array.shift())) {
-      if (array.length === 0) {
-        socket.end();
-      } else {
-        setTimeout(next, timeout);
-      }
+    if (socket.destroyed) {
+      console.log('socket was destroyed early, data left to write:',
+                  array.join('').length);
+      return;
+    }
+
+    const chunk = array.shift();
+
+    if (chunk) {
+      console.log('writing chunk of size', chunk.length);
+      socket.write(chunk, next);
     } else {
-      socket.once('drain', next);
+      socket.end();
     }
   }
 }
 
 function test1() {
+  console.log('test1');
   let headers =
     'HTTP/1.1 200 OK\r\n' +
     'Content-Length: 0\r\n' +
@@ -82,6 +89,9 @@ function test1() {
       writeHeaders(sock, headers);
       sock.resume();
     });
+
+    // The socket might error but that's ok
+    sock.on('error', () => {});
   });
 
   server.listen(0, common.mustCall(() => {
@@ -90,17 +100,17 @@ function test1() {
 
     client.on('error', common.mustCall((err) => {
       assert.strictEqual(err.code, 'HPE_HEADER_OVERFLOW');
-      server.close();
-      setImmediate(test2);
+      server.close(test2);
     }));
   }));
 }
 
 const test2 = common.mustCall(() => {
+  console.log('test2');
   let headers =
     'GET / HTTP/1.1\r\n' +
     'Host: localhost\r\n' +
-    'Agent: node\r\n' +
+    'Agent: nod2\r\n' +
     'X-CRASH: ';
 
   // /, Host, localhost, Agent, node, X-CRASH, a...
@@ -109,7 +119,7 @@ const test2 = common.mustCall(() => {
 
   const server = http.createServer(common.mustNotCall());
 
-  server.on('clientError', common.mustCall((err) => {
+  server.once('clientError', common.mustCall((err) => {
     assert.strictEqual(err.code, 'HPE_HEADER_OVERFLOW');
   }));
 
@@ -121,34 +131,46 @@ const test2 = common.mustCall(() => {
     });
 
     finished(client, common.mustCall((err) => {
-      server.close();
-      setImmediate(test3);
+      server.close(test3);
     }));
   }));
 });
 
 const test3 = common.mustCall(() => {
+  console.log('test3');
   let headers =
     'GET / HTTP/1.1\r\n' +
     'Host: localhost\r\n' +
-    'Agent: node\r\n' +
+    'Agent: nod3\r\n' +
     'X-CRASH: ';
 
   // /, Host, localhost, Agent, node, X-CRASH, a...
   const currentSize = 1 + 4 + 9 + 5 + 4 + 7;
   headers = fillHeaders(headers, currentSize, true);
 
+  console.log('writing', headers.length);
+
   const server = http.createServer(common.mustCall((req, res) => {
-    res.end('hello world');
-    setImmediate(server.close.bind(server));
+    res.end('hello from test3 server');
+    server.close();
   }));
 
+  server.on('clientError', (err) => {
+    console.log(err.code);
+    if (err.code === 'HPE_HEADER_OVERFLOW') {
+      console.log(err.rawPacket.toString('hex'));
+    }
+  });
+  server.on('clientError', common.mustNotCall());
+
   server.listen(0, common.mustCall(() => {
     const client = net.connect(server.address().port);
     client.on('connect', () => {
       writeHeaders(client, headers);
       client.resume();
     });
+
+    client.pipe(process.stdout);
   }));
 });
 
diff --git a/test/sequential/test-set-http-max-http-headers.js b/test/sequential/test-set-http-max-http-headers.js
new file mode 100644
index 00000000000000..7ec13f370784f8
--- /dev/null
+++ b/test/sequential/test-set-http-max-http-headers.js
@@ -0,0 +1,104 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawn } = require('child_process');
+const path = require('path');
+const testName = path.join(__dirname, 'test-http-max-http-headers.js');
+
+const timeout = common.platformTimeout(100);
+
+const tests = [];
+
+function test(fn) {
+  tests.push(fn);
+}
+
+test(function(cb) {
+  console.log('running subtest expecting failure');
+
+  // Validate that the test fails if the max header size is too small.
+  const args = ['--expose-internals',
+                '--max-http-header-size=1024',
+                testName];
+  const cp = spawn(process.execPath, args, { stdio: 'inherit' });
+
+  cp.on('close', common.mustCall((code, signal) => {
+    assert.strictEqual(code, 1);
+    assert.strictEqual(signal, null);
+    cb();
+  }));
+});
+
+test(function(cb) {
+  console.log('running subtest expecting success');
+
+  const env = Object.assign({}, process.env, {
+    NODE_DEBUG: 'http'
+  });
+
+  // Validate that the test fails if the max header size is too small.
+  // Validate that the test now passes if the same limit becomes large enough.
+  const args = ['--expose-internals',
+                '--max-http-header-size=1024',
+                testName,
+                '1024'];
+  const cp = spawn(process.execPath, args, {
+    env,
+    stdio: 'inherit'
+  });
+
+  cp.on('close', common.mustCall((code, signal) => {
+    assert.strictEqual(code, 0);
+    assert.strictEqual(signal, null);
+    cb();
+  }));
+});
+
+// Next, repeat the same checks using NODE_OPTIONS if it is supported.
+if (process.config.variables.node_without_node_options) {
+  const env = Object.assign({}, process.env, {
+    NODE_OPTIONS: '--max-http-header-size=1024'
+  });
+
+  test(function(cb) {
+    console.log('running subtest expecting failure');
+
+    // Validate that the test fails if the max header size is too small.
+    const args = ['--expose-internals', testName];
+    const cp = spawn(process.execPath, args, { env, stdio: 'inherit' });
+
+    cp.on('close', common.mustCall((code, signal) => {
+      assert.strictEqual(code, 1);
+      assert.strictEqual(signal, null);
+      cb();
+    }));
+  });
+
+  test(function(cb) {
+    // Validate that the test now passes if the same limit
+    // becomes large enough.
+    const args = ['--expose-internals', testName, '1024'];
+    const cp = spawn(process.execPath, args, { env, stdio: 'inherit' });
+
+    cp.on('close', common.mustCall((code, signal) => {
+      assert.strictEqual(code, 0);
+      assert.strictEqual(signal, null);
+      cb();
+    }));
+  });
+}
+
+function runTest() {
+  const fn = tests.shift();
+
+  if (!fn) {
+    return;
+  }
+
+  fn(() => {
+    setTimeout(runTest, timeout);
+  });
+}
+
+runTest();

From e6697335950562ba01a43c4ddf4c141628fb39a2 Mon Sep 17 00:00:00 2001
From: Sam Roberts <vieuxtech@gmail.com>
Date: Wed, 28 Nov 2018 09:02:17 -0800
Subject: [PATCH 08/10] doc: describe current HTTP header size limit

Document that the limit was changed from 80KB to 8KB in 186035243.

Fixes: https://github.com/nodejs/node/issues/24693

PR-URL: https://github.com/nodejs/node/pull/24700
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Vse Mozhet Byt <vsemozhetbyt@gmail.com>
---
 doc/api/errors.md | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/doc/api/errors.md b/doc/api/errors.md
index bad6444e471220..4a39f8c4b7be06 100644
--- a/doc/api/errors.md
+++ b/doc/api/errors.md
@@ -1856,9 +1856,15 @@ Creation of a [`zlib`][] object failed due to incorrect configuration.
 
 <a id="HPE_HEADER_OVERFLOW"></a>
 ### HPE_HEADER_OVERFLOW
+<!-- YAML
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/commit/186035243fad247e3955f
+    description: Max header size in `http_parser` was set to 8KB.
+-->
 
 Too much HTTP header data was received. In order to protect against malicious or
-malconfigured clients, if more than 80KB of HTTP header data is received then
+malconfigured clients, if more than 8KB of HTTP header data is received then
 HTTP parsing will abort without a request or response object being created, and
 an `Error` with this code will be emitted.
 

From b6d3afb25734b81b20859d2363cfa91e6ff0a725 Mon Sep 17 00:00:00 2001
From: cjihrig <cjihrig@gmail.com>
Date: Wed, 5 Dec 2018 19:59:12 -0500
Subject: [PATCH 09/10] http: add maxHeaderSize property

This commit exposes the value of --max-http-header-size
as a property of the http module.

PR-URL: https://github.com/nodejs/node/pull/24860
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/http.md                            | 11 +++++++++++
 lib/http.js                                | 14 ++++++++++++++
 test/parallel/test-http-max-header-size.js | 11 +++++++++++
 3 files changed, 36 insertions(+)
 create mode 100644 test/parallel/test-http-max-header-size.js

diff --git a/doc/api/http.md b/doc/api/http.md
index 9a9e5c939ddff2..18c92aa3858586 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -1894,6 +1894,16 @@ added: v0.5.9
 Global instance of `Agent` which is used as the default for all HTTP client
 requests.
 
+## http.maxHeaderSize
+<!-- YAML
+added: REPLACEME
+-->
+
+* {number}
+
+Read-only property specifying the maximum allowed size of HTTP headers in bytes.
+Defaults to 8KB. Configurable using the [`--max-http-header-size`][] CLI option.
+
 ## http.request(options[, callback])
 ## http.request(url[, options][, callback])
 <!-- YAML
@@ -2079,6 +2089,7 @@ will be emitted in the following order:
 Note that setting the `timeout` option or using the `setTimeout()` function will
 not abort the request or do anything besides add a `'timeout'` event.
 
+[`--max-http-header-size`]: cli.html#cli_max_http_header_size_size
 [`'checkContinue'`]: #http_event_checkcontinue
 [`'request'`]: #http_event_request
 [`'response'`]: #http_event_response
diff --git a/lib/http.js b/lib/http.js
index 660de78650f45c..e3707ffa62b25d 100644
--- a/lib/http.js
+++ b/lib/http.js
@@ -32,6 +32,7 @@ const {
   Server,
   ServerResponse
 } = require('_http_server');
+let maxHeaderSize;
 
 function createServer(opts, requestListener) {
   return new Server(opts, requestListener);
@@ -62,3 +63,16 @@ module.exports = {
   get,
   request
 };
+
+Object.defineProperty(module.exports, 'maxHeaderSize', {
+  configurable: true,
+  enumerable: true,
+  get() {
+    if (maxHeaderSize === undefined) {
+      const { getOptionValue } = require('internal/options');
+      maxHeaderSize = getOptionValue('--max-http-header-size');
+    }
+
+    return maxHeaderSize;
+  }
+});
diff --git a/test/parallel/test-http-max-header-size.js b/test/parallel/test-http-max-header-size.js
new file mode 100644
index 00000000000000..07fbe902963525
--- /dev/null
+++ b/test/parallel/test-http-max-header-size.js
@@ -0,0 +1,11 @@
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const http = require('http');
+
+assert.strictEqual(http.maxHeaderSize, 8 * 1024);
+const child = spawnSync(process.execPath, ['--max-http-header-size=10', '-p',
+                                           'http.maxHeaderSize']);
+assert.strictEqual(+child.stdout.toString().trim(), 10);

From 1ae0511b942c01c6e0adff98643d350a395bf101 Mon Sep 17 00:00:00 2001
From: Myles Borins <mylesborins@google.com>
Date: Fri, 21 Dec 2018 18:26:11 -0500
Subject: [PATCH 10/10] 2018-12-26, Version 10.15.0 'Dubnium' (LTS)

The 10.14.0 security release introduced some unexpected breakages on
the 10.x release line. This is a special release to fix a regression
in the HTTP binary upgrade response body and add a missing CLI flag
to adjust the max header size of the http parser.

Notable Changes:

* cli:
  - add --max-http-header-size flag (cjihrig)
    https://github.com/nodejs/node/pull/24811
* http:
  - add maxHeaderSize property (cjihrig)
    https://github.com/nodejs/node/pull/24860

PR-URL: https://github.com/nodejs/node/pull/25176
---
 CHANGELOG.md                    |  3 ++-
 doc/api/cli.md                  |  2 +-
 doc/api/errors.md               |  2 +-
 doc/api/http.md                 |  2 +-
 doc/changelogs/CHANGELOG_V10.md | 27 +++++++++++++++++++++++++++
 src/node_version.h              |  6 +++---
 6 files changed, 35 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6d05bd8013ad19..5482c756de5422 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,7 +26,8 @@ release.
 </tr>
 <tr>
     <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V10.md#10.14.2">10.14.2</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V10.md#10.15.0">10.15.0</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V10.md#10.14.2">10.14.2</a><br/>
 <a href="doc/changelogs/CHANGELOG_V10.md#10.14.1">10.14.1</a><br/>
 <a href="doc/changelogs/CHANGELOG_V10.md#10.14.0">10.14.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V10.md#10.13.0">10.13.0</a><br/>
diff --git a/doc/api/cli.md b/doc/api/cli.md
index d1fbf9432eb376..a994eaa6066765 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -183,7 +183,7 @@ Specify the `file` of the custom [experimental ECMAScript Module][] loader.
 
 ### `--max-http-header-size=size`
 <!-- YAML
-added: REPLACEME
+added: v10.15.0
 -->
 
 Specify the maximum size, in bytes, of HTTP headers. Defaults to 8KB.
diff --git a/doc/api/errors.md b/doc/api/errors.md
index 4a39f8c4b7be06..f51ba038d9cbbf 100644
--- a/doc/api/errors.md
+++ b/doc/api/errors.md
@@ -1858,7 +1858,7 @@ Creation of a [`zlib`][] object failed due to incorrect configuration.
 ### HPE_HEADER_OVERFLOW
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v10.15.0
     pr-url: https://github.com/nodejs/node/commit/186035243fad247e3955f
     description: Max header size in `http_parser` was set to 8KB.
 -->
diff --git a/doc/api/http.md b/doc/api/http.md
index 18c92aa3858586..af4c2c65f53b6c 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -1896,7 +1896,7 @@ requests.
 
 ## http.maxHeaderSize
 <!-- YAML
-added: REPLACEME
+added: v10.15.0
 -->
 
 * {number}
diff --git a/doc/changelogs/CHANGELOG_V10.md b/doc/changelogs/CHANGELOG_V10.md
index 965ee40ac8bb69..9a3c2920a356f6 100644
--- a/doc/changelogs/CHANGELOG_V10.md
+++ b/doc/changelogs/CHANGELOG_V10.md
@@ -10,6 +10,7 @@
 </tr>
 <tr>
 <td valign="top">
+<a href="#10.15.0">10.15.0</a><br/>
 <a href="#10.14.2">10.14.2</a><br/>
 <a href="#10.14.1">10.14.1</a><br/>
 <a href="#10.14.0">10.14.0</a><br/>
@@ -47,6 +48,32 @@
   * [io.js](CHANGELOG_IOJS.md)
   * [Archive](CHANGELOG_ARCHIVE.md)
 
+<a id="10.15.0"></a>
+## 2018-12-26, Version 10.15.0 'Dubnium' (LTS), @MylesBorins
+
+The 10.14.0 security release introduced some unexpected breakages on the 10.x release line.
+This is a special release to fix a regression in the HTTP binary upgrade response body and add
+a missing CLI flag to adjust the max header size of the http parser.
+
+### Notable Changes
+
+* **cli**:
+  - add --max-http-header-size flag (cjihrig) [#24811](https://github.com/nodejs/node/pull/24811)
+* **http**:
+  - add maxHeaderSize property (cjihrig) [#24860](https://github.com/nodejs/node/pull/24860)
+
+### Commits
+
+* [[`9b2ffc81c0`](https://github.com/nodejs/node/commit/9b2ffc81c0)] - **(SEMVER-MINOR)** **cli**: add --max-http-header-size flag (cjihrig) [#24811](https://github.com/nodejs/node/pull/24811)
+* [[`6183c7107d`](https://github.com/nodejs/node/commit/6183c7107d)] - **(SEMVER-MINOR)** **deps**: cherry-pick http\_parser\_set\_max\_header\_size (cjihrig) [#24811](https://github.com/nodejs/node/pull/24811)
+* [[`e669733595`](https://github.com/nodejs/node/commit/e669733595)] - **doc**: describe current HTTP header size limit (Sam Roberts) [#24700](https://github.com/nodejs/node/pull/24700)
+* [[`b6d3afb257`](https://github.com/nodejs/node/commit/b6d3afb257)] - **(SEMVER-MINOR)** **http**: add maxHeaderSize property (cjihrig) [#24860](https://github.com/nodejs/node/pull/24860)
+* [[`1aea1e3634`](https://github.com/nodejs/node/commit/1aea1e3634)] - **http**: fix regression of binary upgrade response body (Matteo Collina) [#25039](https://github.com/nodejs/node/pull/25039)
+* [[`a57aed144a`](https://github.com/nodejs/node/commit/a57aed144a)] - **(SEMVER-MINOR)** **src**: add kUInteger parsing (Matteo Collina) [#24811](https://github.com/nodejs/node/pull/24811)
+* [[`527407c49f`](https://github.com/nodejs/node/commit/527407c49f)] - **src**: cache the result of GetOptions() in JS land (Joyee Cheung) [#24091](https://github.com/nodejs/node/pull/24091)
+* [[`728bc631e5`](https://github.com/nodejs/node/commit/728bc631e5)] - **test**: fix expectation in test-bootstrap-modules (Ali Ijaz Sheikh) [#25112](https://github.com/nodejs/node/pull/25112)
+* [[`3e14212f0e`](https://github.com/nodejs/node/commit/3e14212f0e)] - **test**: remove magic numbers in test-gc-http-client-onerror (Rich Trott) [#24943](https://github.com/nodejs/node/pull/24943)
+
 <a id="10.14.2"></a>
 ## 2018-12-11, Version 10.14.2 'Dubnium' (LTS), @MylesBorins prepared by @codebytere
 
diff --git a/src/node_version.h b/src/node_version.h
index c9d6f49b40ba81..b463eb6763a126 100644
--- a/src/node_version.h
+++ b/src/node_version.h
@@ -23,13 +23,13 @@
 #define SRC_NODE_VERSION_H_
 
 #define NODE_MAJOR_VERSION 10
-#define NODE_MINOR_VERSION 14
-#define NODE_PATCH_VERSION 3
+#define NODE_MINOR_VERSION 15
+#define NODE_PATCH_VERSION 0
 
 #define NODE_VERSION_IS_LTS 1
 #define NODE_VERSION_LTS_CODENAME "Dubnium"
 
-#define NODE_VERSION_IS_RELEASE 0
+#define NODE_VERSION_IS_RELEASE 1
 
 #ifndef NODE_STRINGIFY
 #define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)