[robobun]

Stacked on #44804. Merge #44804 first.

Problem

• In the flat [name, value, ...] list of respond() and request(), an array value goes out as one field joined with ,.
• respond([":status", 200, "set-cookie", ["a=1", "b=2"]]) sends set-cookie: a=1,b=2. Node v26.3.0 sends one field per element.
• Cause: the native walk of a flat list stringifies the value slot (h2_frame_parser.rs:6588).

Fix

• foldRawHeaders() builds the list to encode for both methods: one pair per element of an array. Native code is unchanged.
• assertRawHeaderList() checks every raw list before the encoder runs: the single-value rule per field, then CR, LF or NUL in a value. A bad :path is reported on the stream, as in Node.
• A null element throws ERR_HTTP2_INVALID_HEADER_VALUE from the call, as the object form and pushStream() do (node:http2: send array-valued pushStream() headers as one field per element #37579).
• Verified: test/js/node/http2/node-http2-header-list.test.ts (13 new tests fail on node:http2: copy the array values of a raw header list in respond() and request() #44804). Also node-http2.test.js and 255 upstream test-http2-*.js. Self-reviewed: 10 concerns raised, 9 addressed (the one left is in Notes).

Background

• The encoder writes a block field by field into a table that the peer mirrors (HPACK). A throw in the middle desyncs the table (node:http2: encode each header block in one call, all fields or none #41520).
• Weighed: an array arm in the native walk (this PR's first version). A null element then throws after a partial encode.

Downsides

• A null element throws where Node sends the text null. Bun chose the throw in node:http2: send array-valued pushStream() headers as one field per element #37579.
• Every raw list pays one new array and one scan of its string values. Builtin JS +1,926 B (release bundle).
• cookie with an array of short elements is not never-indexed. nghttp2 decides that per field, in the encoder. A separate change.

Notes

Repro

import http2 from "node:http2";

const lists = {
  array: [":status", 200, "set-cookie", ["a=1", "b=2"]],
  null: [":status", 200, "x-n", ["a", null]],
  crlf: [":status", 200, "x-session", ["sid=mallet", "en\r\nx"]],
  after: [":status", 200, "x-session", "sid=bob"],
};
const server = http2.createServer();
server.on("stream", (stream, headers) => {
  try {
    stream.respond(lists[headers["x-case"]], { sendDate: false });
  } catch (err) {
    stream.respond({ ":status": 500, "x-threw": err.code }, { sendDate: false });
  }
  stream.end();
});
await new Promise(resolve => server.listen(0, "127.0.0.1", resolve));
const client = http2.connect("http://127.0.0.1:" + server.address().port);
client.on("error", err => console.log("session error:", err.code));
for (const name of ["after", "array", "null", "crlf", "after"]) {
  const line = await new Promise(done => {
    const req = client.request({ ":path": "/", "x-case": name });
    let raw = "no response";
    req.on("response", (headers, flags, rawHeaders) => (raw = JSON.stringify(rawHeaders)));
    req.on("error", err => (raw = "stream error: " + err.code));
    req.resume();
    req.on("close", () => done(raw));
    req.end();
  });
  console.log(name.padEnd(5), line);
}
client.destroy();
server.close();

The fields after :status, as the client decoded them:

list	Node v26.3.0	Bun main (bd599f5) and #44804	this PR
array	set-cookie: a=1, set-cookie: b=2	set-cookie: a=1,b=2	set-cookie: a=1, set-cookie: b=2
null	x-n: a, x-n: null	x-n: a,	500, respond() throws
crlf	200, x-session: sid=mallet	500, respond() throws	500, respond() throws
after (the next response)	x-session: sid=bob	x-session: sid=bob	x-session: sid=bob

The crlf row is a difference from Node that main has too: Node drops the element, Bun throws ERR_HTTP2_INVALID_HEADER_VALUE. The null row is the rule of the object form and of pushStream().

Changes after review

• foldRawHeaders() always builds a new list. A caller that changes its own list after a queued request() does not change what is sent.
• The checks run on every raw list, not only on a list with an array. ["content-type", "text/html", "content-type", undefined] is accepted, as in Node. Before, the outcome depended on whether another slot held an array.
• :path is read from the list that is encoded. [":path", "/a\n"], [":path", "/a\n", "x", ["b"]] and [":path", ["/a\n"]] all report NGHTTP2_PROTOCOL_ERROR on the stream, as in Node.
• The throw for a bad value goes through $ERR_HTTP2_INVALID_HEADER_VALUE.
• A null or undefined element throws ERR_HTTP2_INVALID_HEADER_VALUE from the call. An earlier head of this PR sent it as text, as Node does. The merged node:http2: send array-valued pushStream() headers as one field per element #37579 chose the throw for pushStream() to match the object form, so the raw list follows that rule. The test request() and respond() refuse a null or undefined element before the block is encoded covers it.
• The short-cookie never-index rule stays as it was (one string value). nghttp2 applies it per field in the encoder. For an array, Node lists cookie once per short element on the receiver. That needs the rule in encode_header_into_list() (h2_frame_parser.rs), for every form at once, in a separate change.
• The never-index list is no longer written onto the sliced copy of the list in respond(). Nothing read it.
• request() decides the method of a raw list from its last :method slot, as node does. [":method", undefined, ":path", "/"] sends GET with END_STREAM. Before, the folded object held ["GET", undefined] and the request was not ended.

Rules for a raw list

• A queued request() with a bad element throws from the call, not on the stream. Node encodes the block inside request() and throws from the call too.

• An array of a pseudo-header with two or more elements: with strictSingleValueFields: false the elements are joined into one field, as in Node. With the rule on, the pairs are rejected with ERR_HTTP2_HEADER_SINGLE_VALUE.

• The single-value check counts each pair with a value. A null value in a slot is an occurrence, as in Node. An undefined value and an empty array are not.

• An element is coerced with String() inside the call. A toString() that throws makes request() throw at the call on a connecting session too.

• Known difference: respond([":status", "200", ":status", []]) throws ERR_HTTP2_STATUS_INVALID. Main and Node v26.3.0 throw ERR_HTTP2_HEADER_SINGLE_VALUE. Each throws before anything is encoded.

Self-review

• Not addressed: with strictSingleValueFields: false, the elements of a pseudo-header array are joined for a raw list (Node's rule), while the object form still sends one pseudo field per element (native, unchanged). The object form is the subject of node:http2: normalize outbound header objects like node #41614.

Measurements

• Size: release bundle js/node/http2.js 169,374 B to 171,300 B (+1,926 B). No native change, no new host function.
• Per raw-list call: respond() allocates one more Array (the list to encode, next to the slice it already made). request() allocates the same number as before when it adds a pseudo-header (the old concat array is gone) and one more when the caller gave every pseudo-header. Object form: no new allocation.
• Per raw-list call: one JS pass over the string values for CR, LF and NUL. The encoder does the same scan again.
• Not measured: instructions per call (this machine has no PMU and no valgrind).

Not changed here

• node:http2: normalize outbound header objects like node #41614 changes the object form to Node's rule for a null element. If it lands, the raw list should follow it.
• [] in the object form counts as an occurrence of a single-value field (node:http2: an empty array value is not an occurrence of a single-value header #37945).
• A header object given to a queued request() is read when the session connects (related: node:http2: coerce outbound header values before taking a stream id #37568).
• The walk of a flat list skips a slot whose value is null. Node sends null.
• A value with LF: Node drops the field, Bun throws. Same as main.

Suites run with the debug build

• test/js/node/http2/node-http2-header-list.test.ts: 19 pass. On node:http2: copy the array values of a raw header list in respond() and request() #44804, the 13 tests of this PR fail.
• test/js/node/http2/node-http2.test.js: 393 pass, 6 skip.
• test/js/node/test/parallel/test-http2-*.js: 255 pass (test-http2-forget-closed-streams.js not run, it needs about 4 minutes with the debug build).

---

[review] gate passed · iteration 2 · 3 files touched

fails on main (without fix)

ASAN without fix: 10 failed, 6 skipped
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" "test/js/node/http2/node-http2.test.js"
bun test v1.4.0 (07414d2a7)

test/js/node/http2/node-http2.test.js:
(pass) node none > Client Basics > should be able to send a GET request [1158.62ms]
(pass) node none > Client Basics > should be able to send a POST request [808.37ms]
(pass) node none > Client Basics > constants [31.19ms]
(pass) node none > Client Basics > getDefaultSettings [11.54ms]
(pass) node none > Client Basics > getPackedSettings/getUnpackedSettings [30.14ms]
(pass) node none > Client Basics > getUnpackedSettings should throw if buffer is too small [7.81ms]
(pass) node none > Client Basics > getUnpackedSettings should throw if buffer is not a multiple of 6 bytes [4.63ms]
(pass) node none > Client Basics > getUnpackedSettings should throw if buffer is not a buffer [6.34ms]
(pass) node none > Client Basics > should be able to send data using end [867.73ms]
(pass) node none > Client Basics > should be able to mutiplex GET requests [854.94ms]
(pass) node none > Client Basics > http2 should receive remoteSettings when receivin
... (truncated)

release without fix: 18 failed, 6 skipped
bun test v1.4.0-canary.1 (da3851e57)

test/js/node/http2/node-http2.test.js:
(pass) node none > Client Basics > constants [0.92ms]
(pass) node none > Client Basics > getDefaultSettings [0.16ms]
(pass) node none > Client Basics > getPackedSettings/getUnpackedSettings [0.55ms]
(pass) node none > Client Basics > getUnpackedSettings should throw if buffer is too small [0.11ms]
(pass) node none > Client Basics > getUnpackedSettings should throw if buffer is not a multiple of 6 bytes [0.04ms]
(pass) node none > Client Basics > getUnpackedSettings should throw if buffer is not a buffer [0.07ms]
(pass) node none > Client Basics > is possible to abort request [2.82ms]
(pass) node none > Client Basics > aborted event should work with abortController [1.07ms]
(pass) node none > Client Basics > aborted event should work with aborted signal [1.05ms]
(pass) node none > Client Basics > signal validation matches node: non-signal objects throw, duck-typed { aborted } is accepted [1.73ms]
(pass) node none > Client Basics > headers cannot be bigger than 65536 bytes [56.31ms]
(skip) node none > Client Basics > should not leak memory
(pass) node none > Client Basics > should fail to con
... (truncated)

passes on PR (with fix)

ASAN with fix: 6 skipped
$ BUN_DEBUG_QUIET_LOGS=1 bun scripts/build.ts --profile=debug --quiet test "--reporter=junit" "--reporter-outfile=/tmp/mechgate.xml" "test/js/node/http2/node-http2.test.js"
bun test v1.4.0 (07414d2a7)

test/js/node/http2/node-http2.test.js:
(pass) node none > Client Basics > should be able to send a GET request [981.72ms]
(pass) node none > Client Basics > should be able to send a POST request [656.02ms]
(pass) node none > Client Basics > constants [19.17ms]
(pass) node none > Client Basics > getDefaultSettings [7.33ms]
(pass) node none > Client Basics > getPackedSettings/getUnpackedSettings [22.53ms]
(pass) node none > Client Basics > getUnpackedSettings should throw if buffer is too small [5.23ms]
(pass) node none > Client Basics > getUnpackedSettings should throw if buffer is not a multiple of 6 bytes [3.16ms]
(pass) node none > Client Basics > getUnpackedSettings should throw if buffer is not a buffer [4.98ms]
(pass) node none > Client Basics > should be able to send data using end [681.12ms]
(pass) node none > Client Basics > should be able to mutiplex GET requests [672.82ms]
(pass) node none > Client Basics > http2 should receive remoteSettings when receiving 
... (truncated)

release with fix: 6 skipped
$ bun scripts/build.ts --profile=release
[configured] bun-profile → bun (stripped) in 840ms (unchanged)
ninja: Entering directory `/workspace/bun/build/release'
[1/103] gen generated_host_exports.rs
generated_host_exports.rs: 93 exports (host=3, lazy=10, generic=80, rust=0); 239 extern-C blocks audited
[2/103] gen cpp.rs (cppbind)
[3/103] gen JS modules (bundle-modules)
Preprocess modules (9470ms)
Bundle modules (67ms)
Postprocesss modules (218ms)
Bundle Functions (804ms)
Generate Code (39ms)

[10.62s] Bundled "src/js" for production
  2625 kb
  197 internal modules
  13 native modules
  91 internal functions across 17 files
[3/98] cargo bun_bin → libbun_rust.a (--target x86_64-unknown-linux-gnu)

  nightly-2026-07-20-x86_64-unknown-linux-gnu unchanged - rustc 1.99.0-nightly (9f36de775 2026-07-19)

^[[1m^[[92m   Compiling^[[0m bun_simdutf_sys v0.0.0 (/workspace/bun/src/simdutf_sys)
^[[1m^[[92m   Compiling^[[0m bun_core v0.0.0 (/workspace/bun/src/bun_core)
^[[1m^[[92m   Compiling^[[0m bun_errno v0.0.0 (/workspace/bun/src/errno)
^[[1m^[[92m   Compiling^[[0m bun_ptr v0.0.0 (/workspace/bun/src/ptr)
^[[1m^[[92m   Compiling^[[0m bun_boringssl_sys v0.0.0 (/workspace/bun/src/boringssl
... (truncated)

diff hotspot

src/js/node/http2.ts                   |  85 +++++----
 src/runtime/api/bun/h2_frame_parser.rs | 125 +++++++-----
 test/js/node/http2/node-http2.test.js  | 340 +++++++++++++++++++++++++++++++++
 3 files changed, 470 insertions(+), 80 deletions(-)

gate history · 1 passed · 1 rejected · iteration 2

evidence per changed file

file                                    reads  edits  tests
src/js/node/http2.ts                       11     11      0
src/runtime/api/bun/h2_frame_parser.rs      5      6      0
test/js/node/http2/node-http2.test.js       7      9      0

root cause · written by the author bot

The raw flat array header path in the native request encoder, which also serves respond(), converted each value slot straight to a string, so an array value was stringified into a single comma-joined field instead of one field per element as the object form and node already produce. The fix makes that walk compute the number of fields a slot will emit once (none for an empty array, the array length, or one for a scalar), skip empty arrays, apply the single-value header check against that count, and convert, validate and HPACK-encode each element as its own field. The JavaScript side now als…

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 170093f5-afb8-41ec-87eb-cd928940def1

📥 Commits

Reviewing files that changed from the base of the PR and between fee4e36 and 07414d2.

📒 Files selected for processing (1)

• src/runtime/api/bun/h2_frame_parser.rs

Walkthrough

HTTP/2 request and response header handling now preserves raw arrays, validates each header occurrence, and encodes array elements as separate fields. Tests cover duplicates, sensitive headers, empty arrays, single-value restrictions, relaxed validation, and invalid values.

Changes

HTTP/2 header encoding

Layer / File(s)	Summary
Header normalization and validation src/js/node/http2.ts	Raw-header conversion preserves duplicate values and sensitive-header metadata. request() and respond() validate the original raw header list, including single-value constraints.
Native header value encoding src/runtime/api/bun/h2_frame_parser.rs	The request encoder handles scalar and array values through one path. Empty arrays emit no fields. Each element is converted, validated, and HPACK-encoded independently.
Header behavior coverage test/js/node/http2/node-http2.test.js	Tests cover request and response encoding, duplicate and sensitive headers, empty arrays, single-value validation, relaxed validation, and invalid values.

Possibly related PRs

• oven-sh/bun#37568: Both PRs modify outbound HTTP/2 header preprocessing and encoding.
• oven-sh/bun#37579: Both PRs modify array-valued HTTP/2 header encoding and single-value validation.

Suggested reviewers: cirospaciari, dylan-conway, jarred-sumner

Pre-merge checks: 2 · 2

Failed checks: 2 warnings

Check name	Status	Explanation	Resolution
Linked Issues check		Issue #37579 requires pushStream() array encoding and validation, but this PR changes request() and respond() instead.	Implement the pushStream() changes required by #37579, or link this PR to an issue covering request() and respond().
Out of Scope Changes check		The PR changes request() and respond(), while the directly linked issue targets pushStream(), so the implementation is outside the linked scope.	Restrict this PR to pushStream(), or link it to an issue that explicitly covers raw header arrays in request() and respond().

Passed checks: 2 passed

Check name	Status	Explanation
Description check		The description clearly explains the problem, implementation, behavior, tradeoffs, and verification results. It does not use the exact template headings, but it provides the required content and is co…
Title check		The title clearly and concisely describes the primary change: encoding array values in raw HTTP/2 header lists as separate fields.

Full details: Description check

Explanation

The description clearly explains the problem, implementation, behavior, tradeoffs, and verification results. It does not use the exact template headings, but it provides the required content and is complete.

• Fix all pre-merge checks with AI

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[robobun]

^{Updated 10:05 PM PT - Oct 17th, 2026}

❌ @robobun, your commit 0d9bc01 has 1 failures in Build #127963 (All Failures):

• step failed outside runner - exit 1 on 🍎 any aarch64 - test-bun

---

🧪   To try this PR locally:

bunx bun-pr 37796

That installs a local version of the PR into your bun-37796 executable, so you can run:

bun-37796 --bun

[robobun]

Status: reproduced on a release build of main (bd599f5) and on Node v26.3.0 with the script in the description. respond([":status", 200, "set-cookie", ["a=1", "b=2"]]) sends set-cookie: a=1,b=2 on main, and two set-cookie fields on Node and on this branch.

This PR is stacked on #44804. Merge #44804 first. The diff is ready for a maintainer: the http2 suites pass, and the red lanes on the last two CI runs are retried flakes in unrelated suites (install, decorators, napi, fetch-leak, filesink, socket, cluster) and one darwin aarch64 runner failure.

[claude]

I reviewed this PR and didn't find any bugs. Because it changes the native HTTP/2 header-encoding path and carries a deliberate Node divergence plus noted interactions with #33470 and #37568, a human look is still worthwhile.

What was reviewed:

• The new encode_value closure and array branch in the raw-pairs walk against the existing object-form array handling (single-value rule, never-index, empty-array skip, error paths).
• Borrow/provenance of the closure's captures — all methods it calls take &self, so no aliasing conflict with the single_value_headers bookkeeping outside it.
• rawHeadersToObject: traced the array-then-scalar and scalar-then-array duplicate cases to confirm .slice() prevents the encoder from re-reading a mutated caller array.
• Ruled out: session reuse across throwing requests in the single-value test — each throwing case gets its own session or is followed only by the empty-array case.

Extended reasoning...

Overview

This PR fixes node:http2 so that an array in a value slot of the raw [name, value, ...] header form is sent as one field per element, matching Node and Bun's own object-form behavior. It touches three files: the raw-pairs walk in H2FrameParser::request() (h2_frame_parser.rs) gains an array branch that mirrors the existing object-form array handling; src/js/node/http2.ts extracts the duplicated sentHeaders-derivation loop from respond() and ClientHttp2Session.request() into rawHeadersToObject(), adding a .slice() on array values so accumulating later duplicates does not mutate the caller's array (which is what the encoder subsequently reads); and ~290 lines of tests are added to node-http2.test.js covering both directions, queued vs. connected, single-value enforcement, strictSingleValueFields: false, sensitive-header never-indexing, and invalid-element rejection.

Security risks

None identified. The change tightens validation (each array element is now run through is_valid_header_value and null/undefined elements are rejected) rather than relaxing it. No new untrusted-length arithmetic or buffer sizing is introduced; encoding still goes through the existing encode_header_into_list.

Level of scrutiny

Medium-high. This is wire-format code in the HTTP/2 encoder — a subtle mistake here corrupts what peers receive. The Rust change is a careful refactor: the per-value logic is hoisted into a local FnMut closure returning JsResult<Option<JSValue>> so the encode-error early-return path (schedule_header_compression_session_error) can bubble out of both the scalar and per-element call sites. I checked that every captured method (encode_header_into_list, handle_received_stream_id, schedule_header_compression_session_error) takes &self, so the closure's shared borrow of this does not conflict with the single_value_index_checked / single_value_headers[idx] bookkeeping that runs between the closure's definition and its calls. The empty-array continue before the single-value mark is a deliberate (and tested) choice matching Node's buildNgHeaderString.

Other factors

The PR is thorough and self-aware — it documents a deliberate divergence from Node (rejecting null/LF elements, consistent with Bun's object form and #37579), the pre-existing HPACK-desync-on-throw issue (#33470), and a landmine in the concurrently open #37568. Test coverage is strong and asserts on the peer-decoded flat header list rather than sentHeaders alone. That said, the combination of a native protocol-path refactor, a documented compat divergence, and cross-PR ordering concerns is exactly the kind of change a maintainer should sign off on rather than an automated approval.

[robobun]

On the two points flagged for a maintainer: the one divergence from node (an array element that is null or contains CR/LF/NUL throws ERR_HTTP2_INVALID_HEADER_VALUE) is the behavior the object form already has on current bun (client.request({ ":path": "/", "x": ["ok", null] }) throws the same error today), so this change only makes the raw form agree with it; choosing node's stringification instead would be a separate change to both forms plus pushStream(). The ordering interaction with #37568 is noted on that PR; the multi-element and empty-array cases in the new tests (x-multi, set-cookie, x-none) fail if its raw branch lands unchanged on top of this, so it cannot regress silently. No changes planned from this review.

[claude]

I reviewed this PR and didn't find any bugs. The raw-pairs array branch mirrors the object walk's existing shape and the tests cover the wire-visible behaviour end-to-end. Because it restructures the native HPACK header-encoding loop and takes a deliberate Node divergence (rejecting null / CR-LF-NUL array elements rather than stringifying), a maintainer sign-off on that call and on the ordering with #37568 would still be worthwhile.

What was reviewed:

• The new encode_value closure and array/scalar split against the object walk at h2_frame_parser.rs:8448/8484 — same single-value bookkeeping, same per-element null check, same never-index propagation.
• rawHeadersToObject() — the slice() copy prevents the caller-array mutation the tests assert on; both former inline copies (respond/request) are replaced with identical semantics plus the copy.
• Empty-array-before-single-value skips the occurrence bit (matches node's buildNgHeaderString); scalar path is byte-identical to before.

Extended reasoning...

Overview

Three files: src/runtime/api/bun/h2_frame_parser.rs restructures the raw [name, value, ...] header walk inside H2FrameParser::request() so an array in a value slot encodes one HPACK field per element instead of going through Array.prototype.toString; src/js/node/http2.ts extracts the two identical inline sentHeaders-derivation blocks (in ServerHttp2Stream#respond and ClientHttp2Session#request) into rawHeadersToObject() and adds a defensive .slice() so accumulating a later duplicate does not push into the caller's array (which the encoder subsequently reads); ~300 lines of tests in node-http2.test.js covering request/respond, connected/queued, sensitive headers, single-value enforcement, strictSingleValueFields: false, and invalid elements.

Security risks

None identified. Header validation is unchanged for scalars and applied per-element for arrays (the same is_valid_header_value gate and null/undefined rejection the object walk already uses), so this does not open a new injection surface. The single-value rule is enforced on the array as a whole (len > 1 || already_seen), matching the sibling walks.

Level of scrutiny

Medium-high. This is protocol-critical native code on the request/response header path for node:http2, and the diff moves ~40 lines of encoding logic into a closure that is now called from two branches. I compared it line-for-line against the object walk (lines ~8448–8534) and push_promise (lines ~8007–8060), which already have this shape — the new branch is a faithful copy including the Ok(Some(ret)) early-return convention and the compression-error scheduling. The scalar else branch preserves the pre-change behaviour byte-for-byte (single-value check → encode_value(value_js)), so existing callers passing scalars are unaffected.

Other factors

The change carries a deliberate Node.js divergence: null/undefined or CR-LF-NUL-containing array elements throw ERR_HTTP2_INVALID_HEADER_VALUE where Node stringifies them. The PR body argues this matches bun's existing object-form behaviour and #37579's choice for pushStream, which I verified is the pattern at the sibling sites, but per the repo's Node-compat guidance a maintainer should confirm that call. There is also a stated ordering hazard with in-flight #37568 (whose toWireHeaders() would re-join arrays); the new tests would catch it, but landing order matters. The comment-cop bot flags are all resolved (comments were trimmed in a6f9214). Given the native-encoder scope and the compat decision, deferring rather than auto-approving.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/js/node/http2.ts`:
- Around line 4032-4040: Update noteSingleValueField() to return seen
immediately for empty array values before checking or recording single-value
headers, while preserving validation for non-empty arrays and scalar values.
Apply the identical empty-array rule in the native object-form encoder, and add
request and response tests covering differently cased duplicate header names.

In `@src/runtime/api/bun/h2_frame_parser.rs`:
- Around line 8907-8951: Copy the raw header name before any JavaScript
execution can re-enter the runtime: update the header-encoding flow around
name_str.to_slice and the encode_value closure to use an owned slice via
to_slice_clone (or otherwise keep the source values alive) before
sensitive_arg.get_truthy or item.to_js_string runs. Ensure validated_name
remains valid when reused after item.to_js_string, and add a regression covering
a toString() implementation that mutates the raw header array.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 96de372d-877a-4216-b442-2c0852c033e1

📥 Commits

Reviewing files that changed from the base of the PR and between 626034f and 6826664.

📒 Files selected for processing (3)

• src/js/node/http2.ts
• src/runtime/api/bun/h2_frame_parser.rs
• test/js/node/http2/node-http2.test.js

[robobun]

Review summary so far, for whoever picks this up:

• No issue is linked to this PR. The automated pre-merge warnings about a "linked issue" for pushStream() come from the reference to node:http2: send array-valued pushStream() headers as one field per element #37579 in the description, which is the already-merged sibling fix for pushStream(); this PR is the request()/respond() half.
• Two review findings were taken: the single-value pre-check now judges the raw list slot by slot (6826664, with an ordering matrix for both request() and respond()), and the raw walk takes an owned copy of each header name before coercing its values (46fdf86).
• One finding was declined as pre-existing and out of scope (empty arrays in the object form; it needs the JS check and three native encoders changed together) and is being handled separately.
• The fix itself is unchanged since the first commit apart from those two additions; the remaining commits are comment trims and running the new tests sequentially.

[robobun]

Heads-up for rebasing: #37945 changes assertSingleValueHeaders() so that an empty array value is skipped in the object form too (fieldCount === 0 continue), plus the matching value_iter.len == 0 skip in the three native object-form array branches. Whichever of the two lands second will get a small conflict in assertSingleValueHeaders(); if this PR lands second, the skip belongs in noteSingleValueField() (which would also make the explicit empty-array check in the raw branch here redundant). The object-form tests added in #37945 fail if the skip gets lost in the merge, so CI will catch it either way.

[robobun]

The comments of 2026-08-12 and 2026-08-13 on this PR describe its first version: an array arm in the native walk, and a throw for a null element. That version is gone. The current head is 4ff37ff, and the description is rewritten for it.

• The copy of the array values, which stops a kept array from carrying values into later calls, is node:http2: copy the array values of a raw header list in respond() and request() #44804 now. This PR is stacked on it.
• The arrays are expanded in JS. There is no native change.
• A null or undefined element is sent as text, as in Node v26.3.0. The first version threw. The object form and pushStream() still throw (node:http2: send array-valued pushStream() headers as one field per element #37579), so this needs a ruling from a maintainer.
• An element with CR, LF or NUL throws before the encoder runs. Main throws for such a list before it encodes a field, and this version keeps that.

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Additional findings (outside the current diff — GitHub can't attach inline comments there):

• 🟡 src/js/node/http2.ts — nit: Maintainers keep a write that nothing reads any more: the never-index list re-attached to the sliced copy at src/js/node/http2.ts:3579. The only reader of that symbol on the copy was the old rawHeadersList[sensitiveHeaders] fold, which this diff replaced with sensitiveNamesForCopy at src/js/node/http2.ts:3602. Fix: delete line 3579 and the "carry it over" clause of the comment at 3576, keeping sensitiveNamesForCopy as the single source for headersObject[sensitiveHeaders]. foldRawHeaders() never looks at symbol keys and the native array walk ignores them too.

  Why this was flagged

  A caller passes a raw list with list[http2.sensitiveHeaders] = [...] to respond(). The diff reads that list into sensitiveNamesForCopy at src/js/node/http2.ts:3577, then still writes it back onto the slice at src/js/node/http2.ts:3579. On the base branch that write was load-bearing: the old inline fold read rawHeadersList[sensitiveHeaders] from the slice. After the diff, the slice is only consumed by foldRawHeaders() (src/js/node/http2.ts:3600, which reads indexed slots only) and, when no array value is present, by the native request() whose array_iterator never sees symbol keys; the sentHeaders object gets the list directly from sensitiveNamesForCopy at src/js/node/http2.ts:3602. No behaviour changes for users; the cost is dead code and a stale comment left by the PR that made it dead, which the repository's review rules ask to be removed in the same PR.

  Verification: Any respond() call with a raw list carrying list[http2.sensitiveHeaders]. At HEAD src/js/node/http2.ts:3577-3579 the symbol is written back onto the slice. On the base commit the only consumer of that write was the inline fold at base lines 3608-3609, and the diff replaces that with headersObject[sensitiveHeaders] = sensitiveNamesForCopy at HEAD 3602-3603. So the write at 3579 has no reader.

• 🟣 src/js/node/http2.ts — Clients sending cookies as an array in a raw header list get every short cookie field HPACK-indexed after merging, which nghttp2 (and node) never index. foldRawHeaders at src/js/node/http2.ts:3955 stores the copied array as the object value, and buildSensitiveNames at src/js/node/http2.ts:3906 only applies the short-cookie rule when the value is a string, so cookie never enters sensitiveNames while the wire list now carries one short cookie field per element. Fix: when the cookie value is an array, apply the < 20 rule to each element (mark cookie never-index if any element qualifies) so both the raw and object forms match nghttp2; cover ["cookie", ["a=1"]] in the never-index test.

  Why this was flagged

  Trigger: request([":path", "/", "cookie", ["a=1", "b=2"]]) or the same in respond()/push headers, the cookie-splitting form RFC 9113 §8.2.3 recommends. foldRawHeaders (src/js/node/http2.ts:3933-3947) copies the array, pushes one cookie/element pair per element onto the wire list, and at :3955 stores the array copy as object.cookie. buildSensitiveNames (src/js/node/http2.ts:3904-3906) reads that object value, sees typeof cookie !== "string", and does not set map["cookie"]. The native raw walk (src/runtime/api/bun/h2_frame_parser.rs:6590-6597) decides never_index solely from sensitiveNames, so each short cookie element is encoded with indexing into the shared HPACK table. The comment at :3856-3858 states the rule bun intends to mirror (nghttp2 never indexes cookie values < 20 chars); node gets it from nghttp2 for every element. On the base branch the array was sent as one joined field, so this PR is what first produces the per-element short cookie fields the rule targets. Remedy: apply the length rule to array elements in buildSensitiveNames.

  Verification: Trigger: a cookie header whose value slot is an array. foldRawHeaders (src/js/node/http2.ts:3955-3957) stores the copied array as object[key]; buildSensitiveNames (src/js/node/http2.ts:3904-3906) applies the short-cookie never-index rule only when typeof cookie === "string", so an array value never sets map["cookie"]. However the base branch already fails by the same route.

[robobun]

Pushed 05cb9ea, 704626f and 8de7a9f for the review findings.

• The never-index list is no longer written onto the sliced copy in respond(). Nothing read it.
• Every raw list is now judged slot by slot, and the list to encode is always a new array. The outcome no longer depends on whether another slot holds an array, and a queued request() does not read a later change to the caller's array.
• A bad :path is reported on the stream for every form of the list, as in Node.
• A null or undefined element now throws ERR_HTTP2_INVALID_HEADER_VALUE from the call. An earlier head sent it as the text null, as Node does. The merged node:http2: send array-valued pushStream() headers as one field per element #37579 chose the throw for pushStream() to match the object form, so the raw list follows that rule.
• The short-cookie never-index rule is not changed here. nghttp2 applies it per field in the encoder, so an array of short cookies is marked per element there. Bun applies it in JS per name. The per-field rule belongs in the native encoder, for every form at once, which is a separate change.

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.