Skip to content

fix(http-request): prevent uncaught exceptions in async hooks#5392

Merged
knolleary merged 6 commits intonode-red:masterfrom
Dennis-SEG:fix/http-request-uncaught-exceptions
Jan 7, 2026
Merged

fix(http-request): prevent uncaught exceptions in async hooks#5392
knolleary merged 6 commits intonode-red:masterfrom
Dennis-SEG:fix/http-request-uncaught-exceptions

Conversation

@Dennis-SEG
Copy link
Copy Markdown
Contributor

@Dennis-SEG Dennis-SEG commented Dec 23, 2025 •
edited
Loading

This PR fixes several issues that can cause uncaught exceptions and crash Node-RED:

  1. Fixed typo: toLowercase() -> toLowerCase() in getHeaderValue()
  2. Added try-catch to beforeRequest hook
  3. Added try-catch to beforeRedirect hook
  4. Added try-catch to afterResponse hook (digest auth)
  5. Added input validation to extractCookies() with array check
  6. Added input validation to buildDigestHeader() for nonce/realm

These changes ensure that malformed responses or invalid data from servers don't crash the entire Node-RED runtime.

Fixes: Uncaught exceptions in HTTP request node

  • Bugfix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)

Proposed changes

Checklist

  • I have read the contribution guidelines
  • For non-bugfix PRs, I have discussed this change on the forum/slack team.
  • I have run npm run test to verify the unit tests pass
  • I have added suitable unit tests to cover the new/changed functionality

@Dennis-SEG
fix(http-request): prevent uncaught exceptions in async hooks
2355709 
This PR fixes several issues that can cause uncaught exceptions and crash Node-RED:

1. Fixed typo: `toLowercase()` -> `toLowerCase()` in getHeaderValue()
2. Added try-catch to beforeRequest hook
3. Added try-catch to beforeRedirect hook
4. Added try-catch to afterResponse hook (digest auth)
5. Added input validation to extractCookies() with array check
6. Added input validation to buildDigestHeader() for nonce/realm

These changes ensure that malformed responses or invalid data from servers
don't crash the entire Node-RED runtime.

Fixes: Uncaught exceptions in HTTP request node
@linux-foundation-easycla
Copy link
Copy Markdown

linux-foundation-easycla bot commented Dec 23, 2025 •
edited
Loading

CLA Signed

The committers listed above are authorized under a signed CLA.

@hardillb
Copy link
Copy Markdown
Member

hardillb commented Dec 23, 2025

Hi, thanks for this, we will review it properly later,

A quick check, the getHeaderValue() function isn't actually used any more so we should probably just remove it rather than fix the toLowercase() call.

@Dennis-SEG
Copy link
Copy Markdown
Contributor Author

Dennis-SEG commented Dec 23, 2025

Thanks for the quick response! You're right about getHeaderValue() - I'll update the PR to remove that unused function entirely.

We've tested these fixes on our fleet of 2400+ devices running Node-RED in production, and the uncaught exception issues have been resolved. The main culprits were the unprotected async hooks and malformed server responses causing crashes.

(ZJ and knoleary know me - Dennis from Smart-e-Grid)

@Dennis-SEG
Copy link
Copy Markdown
Contributor Author

Dennis-SEG commented Dec 31, 2025

Tests pass on my fork: https://github.com/Dennis-SEG/node-red/actions/runs/20619051251

The CI failure on this PR is an unrelated flaky test in the trigger node (expected 149 to be above 149 - a timing issue).

@knolleary
Copy link
Copy Markdown
Member

knolleary commented Jan 5, 2026

@Dennis-SEG thanks for this. I'm back at my desk after the Christmas break. Will get this reviewed and (hopefully) into this week's maintenance release.

@knolleary
Revert changes to workflow
3e065b5 
Removed 'fix/**' branch from push triggers.
@knolleary knolleary merged commit 721bdbc into node-red:master Jan 7, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@knolleary knolleary knolleary approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@Dennis-SEG @hardillb @knolleary