Multiple HTTP/2 DOS Issues
该报告还没有中文解读。
原文摘录
摘自原文（5955 字符中的一小部分）
A security researcher has conducted a broad survey of HTTP/2 implementations to investigate common Denial of Service attack vectors. The Node.js implementation has been found to be subject to a number of these issues. (On the plus side, we're not the only ones! ;-) ...)
原文中的代码
“Data Dribble” on node.js: node.js seems to queue the data internally. For a 1MB output file requested 100 times in parallel fast enough that node.js is constantly processing input, node.js’s RSS rises by 808MB and then falls by 120MB (for an aggregate rise of 688MB). (Actually, it looks like the …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Node.js 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @jasnell · 版权归作者与 Node.js 所有