[24.x] deps: update nghttp2 to 1.69.0 by mcollina · Pull Request #63164 · nodejs/node

mcollina · 2026-05-07T10:39:49Z

Backport of:

deps: update nghttp2 to 1.69.0 #62891

nodejs-github-bot · 2026-05-07T10:39:54Z

Review requested:

@nodejs/http2
@nodejs/net
@nodejs/security-wg

codecov · 2026-05-07T13:10:19Z

Codecov Report

❌ Patch coverage is 87.50000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.91%. Comparing base (b881658) to head (2756a4d).
⚠️ Report is 66 commits behind head on v24.x-staging.

Files with missing lines	Patch %	Lines
src/node_http2.cc	87.50%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@ Coverage Diff @@## v24.x-staging #63164 +/- ##
=================================================
- Coverage 89.92% 89.91% -0.01% 
=================================================
Files 686 686 Lines 208389 208993 +604 Branches 40077 40184 +107 =================================================
+ Hits 187387 187924 +537 - Misses 13238 13293 +55 - Partials 7764 7776 +12

Files with missing lines	Coverage Δ
src/node_http2.h	`91.61% <ø> (ø)`
src/node_http2.cc	`81.85% <87.50%> (-0.01%)`	⬇️

... and 53 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-05-07T15:36:15Z

CI: https://ci.nodejs.org/job/node-test-pull-request/73232/

aduh95 · 2026-05-07T16:35:01Z

@nodejs/lts how confortable are we to land this on LTS release line given the test changes?

nodejs-github-bot · 2026-05-07T17:57:47Z

CI: https://ci.nodejs.org/job/node-test-pull-request/73239/

mcollina · 2026-05-08T20:17:11Z

We need to backport this update due to GHSA-6933-cjhr-5qg6. I assume we don't want to float a patch on top of nghttp2, which also would not please security scanners.

nodejs-github-bot · 2026-05-11T17:03:36Z

CI: https://ci.nodejs.org/job/node-test-pull-request/73380/

nodejs-github-bot · 2026-05-26T10:18:09Z

CI: https://ci.nodejs.org/job/node-test-pull-request/73734/

PR-URL: nodejs#62891 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

This is a set of src & tests fixes for nghttp2 due to changes in v1.67.0+ which require a selection of changes to how we handle low-level protocol errors when using the latest versions of nghttp2, changing both some src error handling and updating some tests to match. Signed-off-by: Tim Perry <pimterry@gmail.com> PR-URL: nodejs#62891 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

nodejs-github-bot · 2026-05-27T15:35:17Z

CI: https://ci.nodejs.org/job/node-test-pull-request/73786/

nodejs-github-bot · 2026-05-27T18:28:12Z

CI: https://ci.nodejs.org/job/node-test-pull-request/73790/

nodejs-github-bot · 2026-06-11T13:33:57Z

CI: https://ci.nodejs.org/job/node-test-pull-request/74057/

nodejs-github-bot · 2026-06-11T20:31:57Z

CI: https://ci.nodejs.org/job/node-test-pull-request/74063/

PR-URL: #62891 Backport-PR-URL: #63164 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>

This is a set of src & tests fixes for nghttp2 due to changes in v1.67.0+ which require a selection of changes to how we handle low-level protocol errors when using the latest versions of nghttp2, changing both some src error handling and updating some tests to match. Signed-off-by: Tim Perry <pimterry@gmail.com> PR-URL: #62891 Backport-PR-URL: #63164 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>

aduh95 · 2026-06-18T05:04:18Z

Landed in dd627ce...a8a0d12

PR-URL: nodejs#62891 Backport-PR-URL: nodejs#63164 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>

This is a set of src & tests fixes for nghttp2 due to changes in v1.67.0+ which require a selection of changes to how we handle low-level protocol errors when using the latest versions of nghttp2, changing both some src error handling and updating some tests to match. Signed-off-by: Tim Perry <pimterry@gmail.com> PR-URL: nodejs#62891 Backport-PR-URL: nodejs#63164 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Refs: https://hackerone.com/reports/3658225 CVE-ID: CVE-2026-48937

nodejs-github-bot added lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. v24.x Issues that can be reproduced on v24.x or PRs targeting the v24.x-staging branch. labels May 7, 2026

pimterry approved these changes May 7, 2026
View reviewed changes

mcollina changed the title ~~Nghttp2 main updates v24.x staging~~[24.x] deps: update nghttp2 to 1.69.0May 7, 2026

mcollina added the request-ci Add this label to start a Jenkins CI on a PR. label May 7, 2026

github-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label May 7, 2026

trivikr approved these changes May 11, 2026
View reviewed changes

RafaelGSS approved these changes May 13, 2026
View reviewed changes

aduh95 added the request-ci Add this label to start a Jenkins CI on a PR. label May 26, 2026

github-actionsBot removed the request-ci Add this label to start a Jenkins CI on a PR. label May 26, 2026

nodejs-github-botand others added 2 commits May 27, 2026 17:30

deps: update nghttp2 to 1.69.0
7fd2f6c
PR-URL: nodejs#62891 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

aduh95 force-pushed the nghttp2-main-updates-v24.x-staging branch from 3fb51d5 to 2756a4dCompare May 27, 2026 15:31

aduh95 force-pushed the v24.x-staging branch from 2917464 to f05a61dCompare June 18, 2026 04:27

aduh95 closed this Jun 18, 2026

Uh oh!

Uh oh!

Conversation

mcollina commented May 7, 2026• edited by aduh95 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented May 7, 2026

Uh oh!

codecovBot commented May 7, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

nodejs-github-bot commented May 7, 2026

Uh oh!

aduh95 commented May 7, 2026

Uh oh!

nodejs-github-bot commented May 7, 2026

Uh oh!

mcollina commented May 8, 2026

Uh oh!

nodejs-github-bot commented May 11, 2026

Uh oh!

nodejs-github-bot commented May 26, 2026

Uh oh!

nodejs-github-bot commented May 27, 2026

Uh oh!

nodejs-github-bot commented May 27, 2026

Uh oh!

nodejs-github-bot commented Jun 11, 2026

Uh oh!

nodejs-github-bot commented Jun 11, 2026

Uh oh!

aduh95 commented Jun 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

mcollina commented May 7, 2026•
edited by aduh95
Loading

codecovBot commented May 7, 2026•
edited
Loading