Application Runtime Resilience Suite

Suite Overview

Modern applications frequently expose runtime standard libraries (Node.js, Go, Python asyncio) directly to ingress traffic without intermediate reverse proxies. This suite evaluates whether underlying runtime parsers, asynchronous event loops, and header decoders maintain stability under adversarial payload structures.

Node.js Resilience Checks

• cve_2024_22019 — Node.js Chunk Extension Loop: Tests chunk parser evaluation bounds under endless extension tokens.
• cve_2024_22020 — Node.js HTTP/2 CONTINUATION Leak: Evaluates memory pool deallocation on unclosed CONTINUATION frames.
• cve_2024_38360 — Node.js Undici Chunk Stream Leak: Tests undici HTTP client stream buffer bounding against unconsumed responses.
• cve_2025_59465 — Node.js HTTP/2 Malformed HEADERS Crash: Streams malformed HTTP/2 HEADERS frames with invalid HPACK data to verify error boundary safety.
• cve_2025_59466 — Node.js Async Hooks Stack Exhaustion: Sends nested asynchronous callback request bursts to verify async_hooks call-stack limits.
• cve_2026_56846 — Node.js H2 Header Memory Limit Bypass: Streams fragmented HTTP/2 header blocks to test maxSessionMemory enforcement.

Go net/http & TLS Checks

• cve_2024_27983 — Go net/http CONTINUATION CPU Load: Tests Go HTTP/2 server frame decoding CPU bounds.
• cve_2024_24790 — Go net/netip Address Loop Bypass: Evaluates netip parsing under malformed IPv4/IPv6 address strings.
• cve_2025_58186 — Go net/http Cookie Fragment Amplification: Sends requests with hundreds of tiny Cookie header fragments to test Go net/http memory bounds.
• cve_2025_61729 — Go TLS Hostname Verification CPU: Probes Go crypto/tls certificate error formatting CPU consumption under malformed handshakes.

Python aiohttp & EngineIO Checks

• cve_2024_23334 — Python aiohttp Path Evaluation Hang: Tests path normalization evaluation bounds under traversal tokens.
• cve_2024_27306 — Python aiohttp Header Folding Desync: Probes aiohttp HTTP header parsing under obsolete multiline header folding.
• cve_2025_69228 — Python aiohttp Multipart POST Stall: Streams chunked multipart POST bodies with micro-delays to test event loop bounds.
• cve_2025_69230 — Python aiohttp Cookie Storm Logging DoS: Sends high-frequency streams of malformed cookies to test logging I/O backpressure.
• cve_2025_69223 — Python aiohttp Auto Decompress Bomb: Sends compressed payloads to evaluate auto_decompress memory expansion ceilings.
• cve_2026_69244 — Python aiohttp Parser Error Formatting Stall: Tests C parser error formatting bounds.
• cve_2026_48809 — Python EngineIO WebSocket Buffer Growth: Sends continuous oversized WebSocket frames to test incoming buffer ceilings.

Caddy HTTP/3 QPACK Checks

cve_2025_4233 — Caddy / quic-go HTTP/3 QPACK Expansion: Emits HTTP/3 QPACK instruction frames to test quic-go dynamic table memory bounding.

Safe Execution

All probes run against verified customer domains with automatic error-rate and latency circuit breakers.

Related simulations