Triage from upstream issues and PRs

[pi0]

Upstream has so many open PRs and Issues potentially some are valid bugs. Need to investigate and make a quick list of them:

• https://github.com/http-party/node-http-proxy/pulls

---

Critical (crashes / data loss)

• #1634 — req.socket undefined TypeError (crash) → fix(web-incoming): guard req.socket access in error handler #112
• #1600 — Crash when options.target is object → fix(web-outgoing): handle object target in redirect host rewrite #108
• #1559 — Memory leak from broken req.on('aborted') (Node 15.5+) → fix(web-incoming): remove deprecated req.on('aborted') listener #110
• #1580 — Request abort broken on Node 16+ (connection leak) → fix(web-incoming): remove deprecated request abort APIs #107
• #1495 — Body data loss: piping before socket connected → fix(web-incoming): defer pipe until socket connects #111
• #1542 — Client disconnect throws unhandled error → fix(web-incoming): emit econnreset on client disconnect #115
• #1433 — Write to destroyed socket (crash) → fix(ws): guard against writing to destroyed socket #113
• #1439 — Socket read error on WS upgrade failure (crash) → fix(ws): handle response stream errors on failed WS upgrade #116
• #1395 — Crash on invalid response headers → fix(web-outgoing): handle invalid response header characters #106
• #1680 — Forward exceptions on parsing incoming requests to error event → fix(server): catch synchronous exceptions in middleware passes #109
• #1552 — Fix websocket socket close before response → fix(ws): skip writing to closed socket on non-upgrade response #114

High (incorrect behavior)

• #1504 — SSL options overwritten by undefined values → fix(ssl): prevent undefined target values from overwriting ssl options #118
• #1419 — Inconsistent https protocol checks → fix(web-incoming): use isSSL regex for consistent https/wss protocol checks #123
• #1334 — Target URL with query string breaks path merging → fix(utils): preserve target URL query string in path merging #117
• #1487 — Regex replaces http:/ incorrectly in paths (CLOSED)
• #1298 — Protocol-relative URLs not rewritten in Location header
• #1125 — HTTP 303 missing from redirect rewriting → fix(web-outgoing): include HTTP 303 in redirect location rewriting #119
• #1396 — removeChunked missing 204/304 (spec violation) → fix(web-outgoing): strip transfer-encoding on 204/304 #122
• #1551 — Empty header name causes ERR_INVALID_HTTP_TOKEN → fix(web-outgoing): skip empty header names #121
• #1532 — Lowercase x-forwarded-* rejected by some servers
• #1581 — Do not append XHeader values (duplicates) → fix(middleware): do not append duplicate x-forwarded-* header values #120
• #1513 — setRedirectHostRewrite support URL object for options.target
• #1417 — Allow URL objects in hostRewrite
• #1376 — Double slashes in query params when ignorePath: true
• #1273 — Disable 2-minute default incoming timeout
• #1257 — Fix can't set headers when using agent
• #1128 — Bugfix: use upstream proxy
• #1276 — Detect and trim invalid incoming req header name
• #980 — Don't send empty headers (Safari UTF-8 error)
• #965 — Catch invalid headers

Medium (features)

• #1494 — Flush headers immediately for chunked responses
• #1379 — Add x-forwarded-host to WebSocket requests
• #1134 — Support servername (SNI) in TLS requests
• #1150 — Preserve duplicate response headers (CLOSED)
• #1693 — Support function type for options.localAddress
• #1644 — Expose http.request lookup option + types
• #1638 — Respect NODE_TLS_REJECT_UNAUTHORIZED env var
• #1574 — Add lookup option to override DNS lookups
• #1550 — Allow forwarding to multiple endpoints
• #1461 — forcePasses and selfHandleResponse as function callback
• #1415 — Option to enable fall-through on 404
• #1407 — onProxyReqWs async handler
• #1375 — mergeCookies option
• #1335 — Add request source to error handler
• #1301 — WS option to transform client/server streams
• #1285 — Allow any custom agent (not just follow-redirects)
• #1283 — Pass options to proxyRes event
• #1172 — Store request object in proxy errors
• #1108 — Preserve header case for incoming requests
• #1082 — proxyToNext option
• #1063 — Override stream destination for proxy response
• #991 — Intercept/manipulate WebSocket messages

Low (refactors / compat)

• #1411 — Convert to WHATWG URL (WIP)
• #1164 — Simplify outgoing path computation
• #1686 — util._extend deprecation warning (Node 22)
• #1666 — Use Object.assign instead of deprecated util._extend
• #1575 — Replace deprecated util.puts()/util.debug()
• #1144 — Server listen callback → feat(server): listeningCallback #127

Skipped (docs, deps, CI, abandoned)

#1713, #1712, #1709, #1707, #1705, #1704, #1695, #1671, #1670, #1660, #1658, #1629, #1612, #1609, #1593, #1585, #1578, #1577, #1555, #1538, #1533, #1529, #1523, #1522, #1518, #1517, #1516, #1501, #1500, #1485, #1470, #1452, #1441, #1437, #1409, #1406, #1393, #1388, #1386, #1353, #1324, #1301, #1259, #1130, #1003

[muuvmuuv]

I would like to mention on issue that would enable HTTP2 for the proxy which would be a big + for this fork and as an alternative for Angular and Vite dev-servers.

http-party/node-http-proxy#1237

[pi0]

PR is more than welcome if you like to contribute 👍 (also feel free to make a dedicated issue so we can track http2 support separately)