http: coerce content-length to number

marco-ippolito · marco-ippolito · commit 9991788e4a60 · 2025-08-27T19:20:36.000+02:00
PR-URL: #57458 Fixes: #57456 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
diff --git a/lib/_http_outgoing.js b/lib/_http_outgoing.js
@@ -606,7 +606,7 @@ function matchHeader(self, state, field, value) {
       break;
     case 'content-length':
       state.contLen = true;
-      self._contentLength = value;
+      self._contentLength = +value;
       self._removedContLen = false;
       break;
     case 'date':
diff --git a/test/parallel/test-http-content-length-mismatch.js b/test/parallel/test-http-content-length-mismatch.js
@@ -78,3 +78,23 @@ function shouldThrowOnFewerBytes() {
 shouldThrowOnMoreBytes();
 shouldNotThrow();
 shouldThrowOnFewerBytes();
+
+
+{
+  const server = http.createServer(common.mustCall((req, res) => {
+    res.strictContentLength = true;
+    // Pass content-length as string
+    res.setHeader('content-length', '5');
+    res.end('12345');
+  }));
+
+
+  server.listen(0, common.mustCall(() => {
+    http.get({ port: server.address().port }, common.mustCall((res) => {
+      res.resume().on('end', common.mustCall(() => {
+        assert.strictEqual(res.statusCode, 200);
+        server.close();
+      }));
+    }));
+  }));
+}
