http: avoid toLowerCase on the server hot path by anonrig · Pull Request #66120 · nodejs/node

anonrig · 2026-09-19T02:56:51Z

What

#65802 already landed the status/Date/Keep-Alive caches and per-connection bound-function reuse. After that, the HTTP/1 server still allocates on every request for work most applications never need:

requireHostHeader (on by default) and the body-header checks still toLowerCase() every raw name while scanning.
Expect and HTTP/1.0 TE still read req.headers, which builds the whole headers object.
matchHeader() lowercases Title-Case outgoing names (Content-Type, Content-Length, …) on every write.
IncomingMessage allocated a streamOptions object just to set highWaterMark.

This change:

Scans rawHeaders with a non-allocating ASCII compare (asciiEqualIgnoreCase) for Host / Expect / Content-Length / Transfer-Encoding / TE.
Reads Expect and HTTP/1.0 TE from rawHeaders so req.headers stays lazy.
Maps common Title-Case outgoing names without toLowerCase().
Sets IncomingMessage HWM from the socket without allocating streamOptions.

An earlier revision interned parser header names (kInternalized). That is gone: unique attacker-controlled names would pin interned strings for the isolate lifetime (see review).

Wire format is unchanged. req.headers is still lazy and still correct when the application reads it, including unusual HOST / EXPECT casing (test/parallel/test-http-server-raw-header-lookup.js).

Benchmarks

Release build (./configure --without-intl --without-npm) on one machine. Server pinned with taskset -c 0 where noted. Client is wrk.

Combined series vs pre-#65802 (`dd5dfb5250`)

These numbers include both #65802 and an earlier revision of this leftover (including interned names):

bench	baseline	combined	Δ
`http/simple.js` `bytes,len=4,c=50`	111,290 req/s	117,556	+5.6%
`http/incoming_headers.js` `headers=20`	109,783	124,238	+13.2%
`wrk` hello + 8 extra headers (median of 5×8s)	101,799	115,613	+13.6%
same, but read `req.headers.host`	94,629	103,678	+9.6%

This leftover vs current `main` (`357ba2f676` / #65802)

Official http/simple.js and http/incoming_headers.js (repeated 5s wrk runs) overlap with main. I am not claiming a reliable official-bench win on top of #65802.

wrk -t2 -c50 hello + 8 extra headers, 5 interleaved 8s rounds:

handler	`main` median	this PR median	notes
`res.end('hello')`	110,246	118,370	leftover faster in 4/5 rounds; distributions overlap
same, but read `req.headers.host`	100,166	100,894	noise

Sequential 40k keep-alive requests, --expose-gc, heapUsed after warmup:

case	`main` heap Δ	this PR heap Δ
8 extra headers, do not read `req.headers`	+6.30 MB	+4.64 MB
8 extra headers, read `req.headers.host`	+4.36 MB	+3.68 MB
no extra headers	leftover similar or slightly higher

After #65802 the leftover is mainly fewer toLowerCase() copies when scanning extra headers for Host, and not building req.headers for Expect / HTTP/1.0 TE.

Tests

python3 tools/test.py --mode=release --shell <leftover-node>: focused HTTP files passed after the rebase (raw-header lookup, Expect, Host, server, multiheaders, content-length). Pre-rebase series ran 408 test/parallel/test-http-*.js. GitHub Actions on 534f13d7e3 is the current matrix.

AI assistance

A closed-source coding agent helped write and measure this. The HTTP hot path (parserOnIncoming, _storeHeader, CreateHeaders) was read and checked against the existing tests. Benchmark numbers above are from two release binaries on the same machine, not from a model.

Refs: #65802
Refs: #65332

nodejs-github-bot · 2026-09-19T02:56:59Z

Review requested:

@nodejs/http
@nodejs/net

codecov · 2026-09-19T04:57:05Z

Codecov Report

❌ Patch coverage is 95.09804% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.29%. Comparing base (357ba2f) to head (534f13d).
⚠️ Report is 4 commits behind head on main.

Files with missing lines	Patch %	Lines
lib/_http_incoming.js	90.90%	4 Missing ⚠️
lib/_http_outgoing.js	96.55%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #66120   +/-   ##
=======================================
  Coverage   90.29%   90.29%           
=======================================
  Files         790      790           
  Lines      271882   271954   +72     
  Branches    51899    51937   +38     
=======================================
+ Hits       245485   245559   +74     
- Misses      16888    16889    +1     
+ Partials     9509     9506    -3

Files with missing lines	Coverage Δ
lib/_http_server.js	`96.77% <100.00%> (-0.06%)`	⬇️
lib/_http_outgoing.js	`97.90% <96.55%> (-0.03%)`	⬇️
lib/_http_incoming.js	`97.44% <90.90%> (-0.56%)`	⬇️

... and 22 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

After nodejs#65802, Host/Expect/body checks still allocate toLowerCase() copies and Expect/HTTP/1.0 TE still read req.headers. Compare names without allocating, read those values from rawHeaders, intern parser header names, and skip Title-Case toLowerCase on common outgoing fields. Refs: nodejs#65802 Signed-off-by: Yagiz Nizipli <yagiz@nizipli.com> Assisted-by: a closed-source coding agent

anonrig · 2026-09-19T12:05:36Z

Rebased onto #65802 (357ba2f676). The status/Date/Keep-Alive caches and per-connection listener reuse are already on main, so this PR now keeps only the complementary leftover:

non-allocating asciiEqualIgnoreCase instead of toLowerCase() in the Host / body-header scans
Expect and HTTP/1.0 TE via rawHeaders (no req.headers materialization)
interned parser header names
Title-Case skip in matchHeader
IncomingMessage HWM without a streamOptions alloc

The benchmark table in the description was measured against pre-#65802 dd5dfb5250 and overstates the remaining delta. Re-measurement vs current main is in progress.

ronag · 2026-09-19T12:10:28Z

+  Local<String> ToHeaderNameString(Environment* env) const {
+    if (size_ == 0) return String::Empty(env->isolate());
+    return OneByteString(
+        env->isolate(), str_, size_, v8::NewStringType::kInternalized);
+  }
+


Can't this cause a vulnerability? While header names are usually short and a limited set. An attacker could create lots of random fields over many requests causing a huge amount if internalized strings?

Yes. Unique attacker-controlled names would stay in V8's interned string table for the isolate lifetime.

Dropped it in 534f13d. Header names are ordinary strings again; the leftover is the JS rawHeaders scan / lazy Expect-TE path.

anonrig · 2026-09-19T12:15:49Z

Re-measured this leftover against current main (357ba2f676 / #65802), same machine, release --without-intl --without-npm.

Official http/simple.js and incoming_headers.js overlap with main across repeated 5s wrk runs — I am not claiming a reliable official-bench win on top of #65802.

wrk -t2 -c50 hello + 8 extra headers, 5 interleaved 8s rounds (taskset -c 0):

res.end('hello'): main median 110,246 req/s, this PR 118,370 (faster in 4/5 rounds; distributions overlap)
same + req.headers.host: noise (~100.2k vs ~100.9k)

40k sequential keep-alive requests, --expose-gc, heapUsed after warmup, 8 extra headers, no req.headers read: main +6.30 MB, this PR +4.64 MB.

So the leftover after #65802 is mostly fewer toLowerCase() copies on the default Host scan when extra headers are present, plus Expect / HTTP/1.0 TE without materializing req.headers. The description table is updated.

nodejs-github-bot · 2026-09-19T12:27:46Z

CI: https://ci.nodejs.org/job/node-test-pull-request/77635/

Interning every parsed header name lets a client fill the V8 interned string table with unique tokens. Drop that and keep names as ordinary strings. Refs: nodejs#66120 Signed-off-by: Yagiz Nizipli <yagiz@nizipli.com> Assisted-by: a closed-source coding agent

anonrig · 2026-09-19T13:19:05Z

Jenkins run 77635 was started on 9b786ff826 (the interned-name revision). A few sharedlib/SmartOS children failed there; ubuntu2404-x64 and the other Linux nodes passed.

534f13d7e3 drops that C++ intern. request-ci is on the PR, but auto-start-ci needs review:approved on the current head (the earlier approval is on the previous SHA). A re-approve will start Jenkins on this commit.

nodejs-github-bot · 2026-09-19T13:34:12Z

CI: https://ci.nodejs.org/job/node-test-pull-request/77639/

anonrig · 2026-09-19T16:40:50Z

Jenkins 77639 failed only on windows-fanned 80517 (tests failed). Every other 77639 child was green (Linux, sharedlibs including openssl30/35/icu/withoutssl, macOS, AIX, SmartOS, ARM, s390x, POWER9/10).

I cannot read Jenkins consoles from here (403). GitHub Actions Coverage Windows on this SHA passed parallel/test-http-server-raw-header-lookup. Re-added request-ci for a rerun.

github-actions · 2026-09-19T16:41:33Z

Failed to start CI

   ℹ  Existing CI run found: https://ci.nodejs.org/job/node-test-pull-request/77639/
   ✖  Refusing to start a potentially duplicate CI job. Use the "Resume build" button in the Jenkins UI, or start a new CI manually.

Full Auto Start CI output

�[36m⠋�[39m Getting reviews from nodejs/node/pull/66120
�[36m⠋�[39m Getting commits from nodejs/node/pull/66120
�[36m⠙�[39m Validating Jenkins credentials
�[36m⠙�[39m Validating Jenkins credentials
✔  Jenkins credentials valid
�[36m⠹�[39m Getting comments from nodejs/node/pull/66120
�[36m⠸�[39m Querying data for job/node-test-pull-request/77639/
�[36m⠸�[39m Querying data for job/node-test-pull-request/77639/
�[36m⠸�[39m Querying API for job/node-test-pull-request/77639/
✔  Build data downloaded
   ℹ  Existing CI run found: https://ci.nodejs.org/job/node-test-pull-request/77639/
   ✖  Refusing to start a potentially duplicate CI job. Use the "Resume build" button in the Jenkins UI, or start a new CI manually.

View workflow run

anonrig · 2026-09-19T17:59:31Z

auto-start-ci refused a second job for this SHA (ncu-ci --check-for-duplicates still sees 77639). I cannot hit Resume in the Jenkins UI from here.

@ronag — could you Resume 77639, or start a new node-test-pull-request on 534f13d7e3? The only 77639 failure was windows-fanned 80517 (tests failed, not flaky tests failed). Jenkins consoles are 403 without login. GitHub Actions coverage-windows on this SHA passed parallel/test-http-server-raw-header-lookup.

The rhel8-power9le red box is leftover from 77635 (66436); 77639's POWER jobs were green.

panva · 2026-09-19T19:18:51Z

human in the loop is missing here...

anonrig · 2026-09-19T19:35:57Z

human in the loop is missing here...

I'm in the loop. Agent was just baby sitting...

nodejs-github-bot · 2026-09-19T20:11:38Z

CI: https://ci.nodejs.org/job/node-test-pull-request/77655/

anonrig added http Issues and PRs related to the http subsystem. needs-ci PRs that need a full CI run. request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels Sep 19, 2026

nodejs-github-bot added the lib / src Issues and PRs involving general changes in the lib/ or src/ directories. label Sep 19, 2026

cursor Bot force-pushed the cursor/http-perf-a3fb branch 2 times, most recently from fbe7035 to 1fda05a Compare September 19, 2026 03:01

cursor Bot force-pushed the cursor/http-perf-a3fb branch from 16a6107 to 9b786ff Compare September 19, 2026 12:03

anonrig changed the title ~~http: cut per-request work on the server hot path~~ http: avoid toLowerCase on the server hot path Sep 19, 2026

ronag approved these changes Sep 19, 2026

View reviewed changes

ronag reviewed Sep 19, 2026

View reviewed changes

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 19, 2026

anonrig added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 19, 2026

ronag approved these changes Sep 19, 2026

View reviewed changes

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 19, 2026

anonrig added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 19, 2026

github-actions Bot added request-ci-failed Starting CI with the request-ci label failed and requires manual intervention. and removed request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels Sep 19, 2026

Uh oh!

Conversation

anonrig commented Sep 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Benchmarks

Combined series vs pre-#65802 (dd5dfb5250)

This leftover vs current main (357ba2f676 / #65802)

Tests

Related

AI assistance

Uh oh!

nodejs-github-bot commented Sep 19, 2026

Uh oh!

codecov Bot commented Sep 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

anonrig commented Sep 19, 2026

Uh oh!

ronag Sep 19, 2026

Choose a reason for hiding this comment

Uh oh!

ronag Sep 19, 2026

Choose a reason for hiding this comment

Uh oh!

anonrig Sep 19, 2026

Choose a reason for hiding this comment

Uh oh!

anonrig commented Sep 19, 2026

Uh oh!

nodejs-github-bot commented Sep 19, 2026

Uh oh!

anonrig commented Sep 19, 2026

Uh oh!

nodejs-github-bot commented Sep 19, 2026

Uh oh!

anonrig commented Sep 19, 2026

Uh oh!

github-actions Bot commented Sep 19, 2026

Failed to start CI

Uh oh!

anonrig commented Sep 19, 2026

Uh oh!

panva commented Sep 19, 2026

Uh oh!

anonrig commented Sep 19, 2026

Uh oh!

nodejs-github-bot commented Sep 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

anonrig commented Sep 19, 2026 •

edited

Loading

Combined series vs pre-#65802 (`dd5dfb5250`)

This leftover vs current `main` (`357ba2f676` / #65802)

codecov Bot commented Sep 19, 2026 •

edited

Loading