AIKIDO-2026-625161

TL;DR

The permessage-deflate extension flushes a final empty block after decompressing a fragmented, compressed message of at least 2044 bytes, and discards any bytes produced by that flush without checking them against max_size. A crafted compressed message can make the connection accept more decompressed data than the configured message size limit allows. The decoder also does not reject continuation frames with the RSV1 bit set, letting a peer desynchronize the decompressor state. The fix checks the flush output against max_size and rejects RSV1 on continuation frames.