deps: update nghttp2 to 1.67.1

[nodejs-github-bot]

This is an automated update of nghttp2 to 1.67.1.

[nodejs-github-bot]

Review requested:

• @nodejs/http2
• @nodejs/net
• @nodejs/security-wg

[targos]

@nodejs/http2

[targos]

@trivikr This is not ready for review. I pinged the team to look into the failures.

Change not ready for review

[trivikr]

Diff has same files as that from lib folder in nghttp2/nghttp2@v1.66.0...v1.67.0

[trivikr]

The CI failures are either out of memory errors or timeouts.

[lpinca]

Blocked by test failures.

[aduh95]

Bisecting points to nghttp2/nghttp2@7784fa9

Reverting nghttp2/nghttp2@7784fa9 makes the tests pass.

Diff

diff --git a/deps/nghttp2/lib/CMakeLists.txt b/deps/nghttp2/lib/CMakeLists.txt
index 98e3dbe7682..fda8dcb7fc7 100644
--- a/deps/nghttp2/lib/CMakeLists.txt
+++ b/deps/nghttp2/lib/CMakeLists.txt
@@ -47,29 +47,7 @@ if(WIN32)
   set(NGHTTP2_RES ${CMAKE_CURRENT_BINARY_DIR}/version.rc)
 endif()
 
-set(NGHTTP2_GENERATED_DIR "${CMAKE_CURRENT_BINARY_DIR}/generated")
-set(NGHTTP2_VERSION_CONFIG "${NGHTTP2_GENERATED_DIR}/${PROJECT_NAME}ConfigVersion.cmake")
-set(NGHTTP2_PROJECT_CONFIG "${NGHTTP2_GENERATED_DIR}/${PROJECT_NAME}Config.cmake")
-set(NGHTTP2_TARGETS_EXPORT_NAME "${PROJECT_NAME}Targets")
-set(NGHTTP2_CONFIG_INSTALL_DIR "lib/cmake/${PROJECT_NAME}")
-set(NGHTTP2_NAMESPACE "${PROJECT_NAME}::")
-set(NGHTTP2_VERSION ${PROJECT_VERSION})
-
-include(CMakePackageConfigHelpers)
-write_basic_package_version_file(
-  "${NGHTTP2_VERSION_CONFIG}" VERSION ${NGHTTP2_VERSION} COMPATIBILITY SameMajorVersion
-)
-configure_file("${CMAKE_CURRENT_SOURCE_DIR}/config.cmake.in" "${NGHTTP2_PROJECT_CONFIG}" @ONLY)
-
-# Install cmake config files
-install(
-  FILES "${NGHTTP2_PROJECT_CONFIG}" "${NGHTTP2_VERSION_CONFIG}"
-  DESTINATION "${NGHTTP2_CONFIG_INSTALL_DIR}")
-
-install(
-  EXPORT "${NGHTTP2_TARGETS_EXPORT_NAME}"
-  NAMESPACE "${NGHTTP2_NAMESPACE}"
-  DESTINATION "${NGHTTP2_CONFIG_INSTALL_DIR}")
+set(EXPORT_SET "${PROJECT_NAME}-targets")
 
 # Public shared library
 if(BUILD_SHARED_LIBS)
@@ -87,11 +65,7 @@ if(BUILD_SHARED_LIBS)
     $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
   )
 
-  install(TARGETS ${SHARED_LIB}
-    EXPORT ${NGHTTP2_TARGETS_EXPORT_NAME}
-    ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}"
-    LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}"
-    RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}")
+  install(TARGETS ${SHARED_LIB} EXPORT ${EXPORT_SET})
   list(APPEND nghttp2_exports ${SHARED_LIB})
 endif()
 
@@ -113,9 +87,7 @@ if(BUILD_STATIC_LIBS)
 
   target_compile_definitions(${STATIC_LIB} PUBLIC "-DNGHTTP2_STATICLIB")
 
-  install(TARGETS ${STATIC_LIB}
-    EXPORT ${NGHTTP2_TARGETS_EXPORT_NAME}
-    ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}")
+  install(TARGETS ${STATIC_LIB} EXPORT ${EXPORT_SET})
   list(APPEND nghttp2_exports ${STATIC_LIB})
 endif()
 
@@ -125,7 +97,11 @@ else()
   set(LIB_SELECTED ${STATIC_LIB})
 endif()
 
-add_library(nghttp2 ALIAS ${LIB_SELECTED})
+add_library(${PROJECT_NAME}::nghttp2 ALIAS ${LIB_SELECTED})
 
 install(FILES "${CMAKE_CURRENT_BINARY_DIR}/libnghttp2.pc"
   DESTINATION "${CMAKE_INSTALL_LIBDIR}/pkgconfig")
+
+install(EXPORT ${EXPORT_SET}
+  DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}
+  NAMESPACE ${PROJECT_NAME}::)
diff --git a/deps/nghttp2/lib/Makefile.am b/deps/nghttp2/lib/Makefile.am
index 3a743df6ae7..1168c1e6135 100644
--- a/deps/nghttp2/lib/Makefile.am
+++ b/deps/nghttp2/lib/Makefile.am
@@ -22,7 +22,7 @@
 # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 SUBDIRS = includes
 
-EXTRA_DIST = Makefile.msvc CMakeLists.txt version.rc.in config.cmake.in
+EXTRA_DIST = Makefile.msvc CMakeLists.txt version.rc.in
 
 AM_CFLAGS = $(WARNCFLAGS) $(EXTRACFLAG)
 AM_CPPFLAGS = -I$(srcdir)/includes -I$(builddir)/includes -DBUILDING_NGHTTP2 \
diff --git a/deps/nghttp2/lib/Makefile.in b/deps/nghttp2/lib/Makefile.in
index bb458a182c9..900e89c7cce 100644
--- a/deps/nghttp2/lib/Makefile.in
+++ b/deps/nghttp2/lib/Makefile.in
@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.16.5 from Makefile.am.
+# Makefile.in generated by automake 1.18.1 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2021 Free Software Foundation, Inc.
+# Copyright (C) 1994-2025 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -86,6 +86,8 @@ am__make_running_with_option = \
   test $$has_opt = yes
 am__make_dryrun = (target_option=n; $(am__make_running_with_option))
 am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+am__rm_f = rm -f $(am__rm_f_notfound)
+am__rm_rf = rm -rf $(am__rm_f_notfound)
 pkgdatadir = $(datadir)/@PACKAGE@
 pkgincludedir = $(includedir)/@PACKAGE@
 pkglibdir = $(libdir)/@PACKAGE@
@@ -141,10 +143,9 @@ am__base_list = \
   sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
   sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
 am__uninstall_files_from_dir = { \
-  test -z "$$files" \
-    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
-    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
-         $(am__cd) "$$dir" && rm -f $$files; }; \
+  { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
+  || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+       $(am__cd) "$$dir" && echo $$files | $(am__xargs_n) 40 $(am__rm_f); }; \
   }
 am__installdirs = "$(DESTDIR)$(libdir)" "$(DESTDIR)$(pkgconfigdir)"
 LTLIBRARIES = $(lib_LTLIBRARIES)
@@ -360,8 +361,6 @@ LIBNGHTTP3_LIBS = @LIBNGHTTP3_LIBS@
 LIBNGTCP2_CFLAGS = @LIBNGTCP2_CFLAGS@
 LIBNGTCP2_CRYPTO_BORINGSSL_CFLAGS = @LIBNGTCP2_CRYPTO_BORINGSSL_CFLAGS@
 LIBNGTCP2_CRYPTO_BORINGSSL_LIBS = @LIBNGTCP2_CRYPTO_BORINGSSL_LIBS@
-LIBNGTCP2_CRYPTO_LIBRESSL_CFLAGS = @LIBNGTCP2_CRYPTO_LIBRESSL_CFLAGS@
-LIBNGTCP2_CRYPTO_LIBRESSL_LIBS = @LIBNGTCP2_CRYPTO_LIBRESSL_LIBS@
 LIBNGTCP2_CRYPTO_OSSL_CFLAGS = @LIBNGTCP2_CRYPTO_OSSL_CFLAGS@
 LIBNGTCP2_CRYPTO_OSSL_LIBS = @LIBNGTCP2_CRYPTO_OSSL_LIBS@
 LIBNGTCP2_CRYPTO_QUICTLS_CFLAGS = @LIBNGTCP2_CRYPTO_QUICTLS_CFLAGS@
@@ -436,8 +435,10 @@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
 am__quote = @am__quote@
+am__rm_f_notfound = @am__rm_f_notfound@
 am__tar = @am__tar@
 am__untar = @am__untar@
+am__xargs_n = @am__xargs_n@
 bindir = @bindir@
 build = @build@
 build_alias = @build_alias@
@@ -496,7 +497,7 @@ top_srcdir = @top_srcdir@
 # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 SUBDIRS = includes
-EXTRA_DIST = Makefile.msvc CMakeLists.txt version.rc.in config.cmake.in
+EXTRA_DIST = Makefile.msvc CMakeLists.txt version.rc.in
 AM_CFLAGS = $(WARNCFLAGS) $(EXTRACFLAG)
 AM_CPPFLAGS = -I$(srcdir)/includes -I$(builddir)/includes -DBUILDING_NGHTTP2 \
 	@DEFS@
@@ -612,15 +613,13 @@ uninstall-libLTLIBRARIES:
 	done
 
 clean-libLTLIBRARIES:
-	-test -z "$(lib_LTLIBRARIES)" || rm -f $(lib_LTLIBRARIES)
+	-$(am__rm_f) $(lib_LTLIBRARIES)
 	@list='$(lib_LTLIBRARIES)'; \
 	locs=`for p in $$list; do echo $$p; done | \
 	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
 	      sort -u`; \
-	test -z "$$locs" || { \
-	  echo rm -f $${locs}; \
-	  rm -f $${locs}; \
-	}
+	echo rm -f $${locs}; \
+	$(am__rm_f) $${locs}
 
 libnghttp2.la: $(libnghttp2_la_OBJECTS) $(libnghttp2_la_DEPENDENCIES) $(EXTRA_libnghttp2_la_DEPENDENCIES) 
 	$(AM_V_CCLD)$(libnghttp2_la_LINK) -rpath $(libdir) $(libnghttp2_la_OBJECTS) $(libnghttp2_la_LIBADD) $(LIBS)
@@ -660,7 +659,7 @@ distclean-compile:
 
 $(am__depfiles_remade):
 	@$(MKDIR_P) $(@D)
-	@echo '# dummy' >$@-t && $(am__mv) $@-t $@
+	@: >>$@
 
 am--depfiles: $(am__depfiles_remade)
 
@@ -813,6 +812,7 @@ cscopelist-am: $(am__tagged_files)
 
 distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
 distdir: $(BUILT_SOURCES)
 	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 
@@ -903,9 +903,9 @@ mostlyclean-generic:
 clean-generic:
 
 distclean-generic:
-	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
-	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
-	-test -z "$(DISTCLEANFILES)" || rm -f $(DISTCLEANFILES)
+	-$(am__rm_f) $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || $(am__rm_f) $(CONFIG_CLEAN_VPATH_FILES)
+	-$(am__rm_f) $(DISTCLEANFILES)
 
 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
@@ -916,7 +916,7 @@ clean-am: clean-generic clean-libLTLIBRARIES clean-libtool \
 	mostlyclean-am
 
 distclean: distclean-recursive
-		-rm -f ./$(DEPDIR)/nghttp2_alpn.Plo
+	-rm -f ./$(DEPDIR)/nghttp2_alpn.Plo
 	-rm -f ./$(DEPDIR)/nghttp2_buf.Plo
 	-rm -f ./$(DEPDIR)/nghttp2_callbacks.Plo
 	-rm -f ./$(DEPDIR)/nghttp2_debug.Plo
@@ -987,7 +987,7 @@ install-ps-am:
 installcheck-am:
 
 maintainer-clean: maintainer-clean-recursive
-		-rm -f ./$(DEPDIR)/nghttp2_alpn.Plo
+	-rm -f ./$(DEPDIR)/nghttp2_alpn.Plo
 	-rm -f ./$(DEPDIR)/nghttp2_buf.Plo
 	-rm -f ./$(DEPDIR)/nghttp2_callbacks.Plo
 	-rm -f ./$(DEPDIR)/nghttp2_debug.Plo
@@ -1055,3 +1055,10 @@ uninstall-am: uninstall-libLTLIBRARIES uninstall-pkgconfigDATA
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
 .NOEXPORT:
+
+# Tell GNU make to disable its built-in pattern rules.
+%:: %,v
+%:: RCS/%,v
+%:: RCS/%
+%:: s.%
+%:: SCCS/s.%
diff --git a/deps/nghttp2/lib/config.cmake.in b/deps/nghttp2/lib/config.cmake.in
deleted file mode 100644
index 0b677718f46..00000000000
--- a/deps/nghttp2/lib/config.cmake.in
+++ /dev/null
@@ -1,3 +0,0 @@
-include(CMakeFindDependencyMacro)
-
-include("${CMAKE_CURRENT_LIST_DIR}/@[email protected]")
diff --git a/deps/nghttp2/lib/includes/Makefile.in b/deps/nghttp2/lib/includes/Makefile.in
index a4687390385..01cd60afbd9 100644
--- a/deps/nghttp2/lib/includes/Makefile.in
+++ b/deps/nghttp2/lib/includes/Makefile.in
@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.16.5 from Makefile.am.
+# Makefile.in generated by automake 1.18.1 from Makefile.am.
 # @configure_input@
 
-# Copyright (C) 1994-2021 Free Software Foundation, Inc.
+# Copyright (C) 1994-2025 Free Software Foundation, Inc.
 
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -93,6 +93,8 @@ am__make_running_with_option = \
   test $$has_opt = yes
 am__make_dryrun = (target_option=n; $(am__make_running_with_option))
 am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+am__rm_f = rm -f $(am__rm_f_notfound)
+am__rm_rf = rm -rf $(am__rm_f_notfound)
 pkgdatadir = $(datadir)/@PACKAGE@
 pkgincludedir = $(includedir)/@PACKAGE@
 pkglibdir = $(libdir)/@PACKAGE@
@@ -168,10 +170,9 @@ am__base_list = \
   sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
   sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
 am__uninstall_files_from_dir = { \
-  test -z "$$files" \
-    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
-    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
-         $(am__cd) "$$dir" && rm -f $$files; }; \
+  { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
+  || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+       $(am__cd) "$$dir" && echo $$files | $(am__xargs_n) 40 $(am__rm_f); }; \
   }
 am__installdirs = "$(DESTDIR)$(includedir)"
 HEADERS = $(nobase_include_HEADERS)
@@ -265,8 +266,6 @@ LIBNGHTTP3_LIBS = @LIBNGHTTP3_LIBS@
 LIBNGTCP2_CFLAGS = @LIBNGTCP2_CFLAGS@
 LIBNGTCP2_CRYPTO_BORINGSSL_CFLAGS = @LIBNGTCP2_CRYPTO_BORINGSSL_CFLAGS@
 LIBNGTCP2_CRYPTO_BORINGSSL_LIBS = @LIBNGTCP2_CRYPTO_BORINGSSL_LIBS@
-LIBNGTCP2_CRYPTO_LIBRESSL_CFLAGS = @LIBNGTCP2_CRYPTO_LIBRESSL_CFLAGS@
-LIBNGTCP2_CRYPTO_LIBRESSL_LIBS = @LIBNGTCP2_CRYPTO_LIBRESSL_LIBS@
 LIBNGTCP2_CRYPTO_OSSL_CFLAGS = @LIBNGTCP2_CRYPTO_OSSL_CFLAGS@
 LIBNGTCP2_CRYPTO_OSSL_LIBS = @LIBNGTCP2_CRYPTO_OSSL_LIBS@
 LIBNGTCP2_CRYPTO_QUICTLS_CFLAGS = @LIBNGTCP2_CRYPTO_QUICTLS_CFLAGS@
@@ -341,8 +340,10 @@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
 am__quote = @am__quote@
+am__rm_f_notfound = @am__rm_f_notfound@
 am__tar = @am__tar@
 am__untar = @am__untar@
+am__xargs_n = @am__xargs_n@
 bindir = @bindir@
 build = @build@
 build_alias = @build_alias@
@@ -508,6 +509,7 @@ cscopelist-am: $(am__tagged_files)
 
 distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
 distdir: $(BUILT_SOURCES)
 	$(MAKE) $(AM_MAKEFLAGS) distdir-am
 
@@ -572,8 +574,8 @@ mostlyclean-generic:
 clean-generic:
 
 distclean-generic:
-	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
-	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+	-$(am__rm_f) $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || $(am__rm_f) $(CONFIG_CLEAN_VPATH_FILES)
 
 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
@@ -666,3 +668,10 @@ uninstall-am: uninstall-nobase_includeHEADERS
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
 .NOEXPORT:
+
+# Tell GNU make to disable its built-in pattern rules.
+%:: %,v
+%:: RCS/%,v
+%:: RCS/%
+%:: s.%
+%:: SCCS/s.%
diff --git a/deps/nghttp2/lib/includes/nghttp2/nghttp2.h b/deps/nghttp2/lib/includes/nghttp2/nghttp2.h
index 19c1874f23a..16ce542d757 100644
--- a/deps/nghttp2/lib/includes/nghttp2/nghttp2.h
+++ b/deps/nghttp2/lib/includes/nghttp2/nghttp2.h
@@ -2039,19 +2039,18 @@ typedef int (*nghttp2_on_header_callback2)(nghttp2_session *session,
 /**
  * @functypedef
  *
- * Callback function invoked when an invalid header name/value pair is
+ * Callback function invoked when a invalid header name/value pair is
  * received for the |frame|.
  *
  * The parameter and behaviour are similar to
  * :type:`nghttp2_on_header_callback`.  The difference is that this
- * callback is only invoked when an invalid header name/value pair is
- * received which is treated as stream error if this callback returns
- * :enum:`nghttp2_error.NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE` and
- * :type:`nghttp2_on_invalid_header_callback2` is not set.  Only
- * invalid regular header field are passed to this callback.  In other
- * words, invalid pseudo header field is not passed to this callback.
- * Also header fields which includes upper cased latter are also
- * treated as error without passing them to this callback.
+ * callback is only invoked when a invalid header name/value pair is
+ * received which is treated as stream error if this callback is not
+ * set.  Only invalid regular header field are passed to this
+ * callback.  In other words, invalid pseudo header field is not
+ * passed to this callback.  Also header fields which includes upper
+ * cased latter are also treated as error without passing them to this
+ * callback.
  *
  * This callback is only considered if HTTP messaging validation is
  * turned on (which is on by default, see
@@ -2077,18 +2076,17 @@ typedef int (*nghttp2_on_invalid_header_callback)(
 /**
  * @functypedef
  *
- * Callback function invoked when an invalid header name/value pair is
+ * Callback function invoked when a invalid header name/value pair is
  * received for the |frame|.
  *
  * The parameter and behaviour are similar to
  * :type:`nghttp2_on_header_callback2`.  The difference is that this
- * callback is only invoked when an invalid header name/value pair is
- * received which is silently ignored if neither this callback nor
- * :type:`nghttp2_on_invalid_header_callback` is set.  Only invalid
- * regular header field are passed to this callback.  In other words,
- * invalid pseudo header field is not passed to this callback.  Also
- * header fields which includes upper cased latter are also treated as
- * error without passing them to this callback.
+ * callback is only invoked when a invalid header name/value pair is
+ * received which is silently ignored if this callback is not set.
+ * Only invalid regular header field are passed to this callback.  In
+ * other words, invalid pseudo header field is not passed to this
+ * callback.  Also header fields which includes upper cased latter are
+ * also treated as error without passing them to this callback.
  *
  * This callback is only considered if HTTP messaging validation is
  * turned on (which is on by default, see
@@ -2660,7 +2658,7 @@ NGHTTP2_EXTERN void nghttp2_session_callbacks_set_on_header_callback2(
 /**
  * @function
  *
- * Sets callback function invoked when an invalid header name/value
+ * Sets callback function invoked when a invalid header name/value
  * pair is received.  If both
  * `nghttp2_session_callbacks_set_on_invalid_header_callback()` and
  * `nghttp2_session_callbacks_set_on_invalid_header_callback2()` are
@@ -2673,7 +2671,7 @@ NGHTTP2_EXTERN void nghttp2_session_callbacks_set_on_invalid_header_callback(
 /**
  * @function
  *
- * Sets callback function invoked when an invalid header name/value
+ * Sets callback function invoked when a invalid header name/value
  * pair is received.
  */
 NGHTTP2_EXTERN void nghttp2_session_callbacks_set_on_invalid_header_callback2(
@@ -3241,23 +3239,6 @@ nghttp2_option_set_stream_reset_rate_limit(nghttp2_option *option,
 NGHTTP2_EXTERN void nghttp2_option_set_max_continuations(nghttp2_option *option,
                                                          size_t val);
 
-/**
- * @function
- *
- * This function sets the rate limit for the "glitches", the
- * suspicious activities from a remote endpoint.  It is a token-bucket
- * based rate limiter.  |burst| specifies the number of tokens that is
- * initially available.  The maximum number of tokens is capped to
- * this value.  |rate| specifies the number of tokens that are
- * regenerated per second.  When a suspicious activity is detected,
- * some amount of tokens are consumed.  If there is no token
- * available, GOAWAY is sent to tear down the connection.  |burst| and
- * |rate| default to 1000 and 33 respectively.
- */
-NGHTTP2_EXTERN void nghttp2_option_set_glitch_rate_limit(nghttp2_option *option,
-                                                         uint64_t burst,
-                                                         uint64_t rate);
-
 /**
  * @function
  *
diff --git a/deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h b/deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h
index bd5e6c28723..9d74f2ec042 100644
--- a/deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h
+++ b/deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h
@@ -29,7 +29,7 @@
  * @macro
  * Version number of the nghttp2 library release
  */
-#define NGHTTP2_VERSION "1.67.1"
+#define NGHTTP2_VERSION "1.67.0-DEV"
 
 /**
  * @macro
@@ -37,6 +37,6 @@
  * release. This is a 24 bit number with 8 bits for major number, 8 bits
  * for minor and 8 bits for patch. Version 1.2.3 becomes 0x010203.
  */
-#define NGHTTP2_VERSION_NUM 0x014301
+#define NGHTTP2_VERSION_NUM 0x014300
 
 #endif /* NGHTTP2VER_H */
diff --git a/deps/nghttp2/lib/nghttp2_int.h b/deps/nghttp2/lib/nghttp2_int.h
index 5ee6b313a01..b23585ccb27 100644
--- a/deps/nghttp2/lib/nghttp2_int.h
+++ b/deps/nghttp2/lib/nghttp2_int.h
@@ -52,11 +52,7 @@ typedef enum {
    * Unlike NGHTTP2_ERR_IGN_HTTP_HEADER, this does not invoke
    * nghttp2_on_invalid_header_callback.
    */
-  NGHTTP2_ERR_REMOVE_HTTP_HEADER = -106,
-  /*
-   * Cancel pushed stream.
-   */
-  NGHTTP2_ERR_PUSH_CANCEL = -107,
+  NGHTTP2_ERR_REMOVE_HTTP_HEADER = -106
 } nghttp2_internal_error;
 
 #endif /* NGHTTP2_INT_H */
diff --git a/deps/nghttp2/lib/nghttp2_option.c b/deps/nghttp2/lib/nghttp2_option.c
index 7e44a241ba1..02a24eee6b2 100644
--- a/deps/nghttp2/lib/nghttp2_option.c
+++ b/deps/nghttp2/lib/nghttp2_option.c
@@ -155,10 +155,3 @@ void nghttp2_option_set_max_continuations(nghttp2_option *option, size_t val) {
   option->opt_set_mask |= NGHTTP2_OPT_MAX_CONTINUATIONS;
   option->max_continuations = val;
 }
-
-void nghttp2_option_set_glitch_rate_limit(nghttp2_option *option,
-                                          uint64_t burst, uint64_t rate) {
-  option->opt_set_mask |= NGHTTP2_OPT_GLITCH_RATE_LIMIT;
-  option->glitch_burst = burst;
-  option->glitch_rate = rate;
-}
diff --git a/deps/nghttp2/lib/nghttp2_option.h b/deps/nghttp2/lib/nghttp2_option.h
index 78fa21e4a77..c89cb97f8bb 100644
--- a/deps/nghttp2/lib/nghttp2_option.h
+++ b/deps/nghttp2/lib/nghttp2_option.h
@@ -72,7 +72,6 @@ typedef enum {
   NGHTTP2_OPT_NO_RFC9113_LEADING_AND_TRAILING_WS_VALIDATION = 1 << 14,
   NGHTTP2_OPT_STREAM_RESET_RATE_LIMIT = 1 << 15,
   NGHTTP2_OPT_MAX_CONTINUATIONS = 1 << 16,
-  NGHTTP2_OPT_GLITCH_RATE_LIMIT = 1 << 17,
 } nghttp2_option_flag;
 
 /**
@@ -84,11 +83,6 @@ struct nghttp2_option {
    */
   uint64_t stream_reset_burst;
   uint64_t stream_reset_rate;
-  /**
-   * NGHTTP2_OPT_GLITCH_RATE_LIMIT
-   */
-  uint64_t glitch_burst;
-  uint64_t glitch_rate;
   /**
    * NGHTTP2_OPT_MAX_SEND_HEADER_BLOCK_LENGTH
    */
diff --git a/deps/nghttp2/lib/nghttp2_session.c b/deps/nghttp2/lib/nghttp2_session.c
index a7ab61d29a5..2d7bb7bb971 100644
--- a/deps/nghttp2/lib/nghttp2_session.c
+++ b/deps/nghttp2/lib/nghttp2_session.c
@@ -475,10 +475,6 @@ static int session_new(nghttp2_session **session_ptr,
                        NGHTTP2_DEFAULT_STREAM_RESET_BURST,
                        NGHTTP2_DEFAULT_STREAM_RESET_RATE);
 
-  nghttp2_ratelim_init(&(*session_ptr)->glitch_ratelim,
-                       NGHTTP2_DEFAULT_GLITCH_BURST,
-                       NGHTTP2_DEFAULT_GLITCH_RATE);
-
   if (server) {
     (*session_ptr)->server = 1;
   }
@@ -571,11 +567,6 @@ static int session_new(nghttp2_session **session_ptr,
     if (option->opt_set_mask & NGHTTP2_OPT_MAX_CONTINUATIONS) {
       (*session_ptr)->max_continuations = option->max_continuations;
     }
-
-    if (option->opt_set_mask & NGHTTP2_OPT_GLITCH_RATE_LIMIT) {
-      nghttp2_ratelim_init(&(*session_ptr)->glitch_ratelim,
-                           option->glitch_burst, option->glitch_rate);
-    }
   }
 
   rv = nghttp2_hd_deflate_init2(&(*session_ptr)->hd_deflater,
@@ -3272,9 +3263,7 @@ static int session_call_on_invalid_header(nghttp2_session *session,
       session, frame, nv->name->base, nv->name->len, nv->value->base,
       nv->value->len, nv->flags, session->user_data);
   } else {
-    /* If both callbacks are not set, the invalid field nv is
-       ignored. */
-    return 0;
+    return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
   }
 
   if (rv == NGHTTP2_ERR_PAUSE || rv == NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE) {
@@ -3359,10 +3348,6 @@ static uint32_t get_error_code_from_lib_error_code(int lib_error_code) {
   case NGHTTP2_ERR_HTTP_HEADER:
   case NGHTTP2_ERR_HTTP_MESSAGING:
     return NGHTTP2_PROTOCOL_ERROR;
-  case NGHTTP2_ERR_INTERNAL:
-    return NGHTTP2_INTERNAL_ERROR;
-  case NGHTTP2_ERR_PUSH_CANCEL:
-    return NGHTTP2_CANCEL;
   default:
     return NGHTTP2_INTERNAL_ERROR;
   }
@@ -3389,32 +3374,17 @@ static int session_call_on_invalid_frame_recv_callback(nghttp2_session *session,
   return 0;
 }
 
-static int session_update_glitch_ratelim(nghttp2_session *session) {
-  if (session->goaway_flags & NGHTTP2_GOAWAY_TERM_ON_SEND) {
-    return 0;
-  }
-
-  nghttp2_ratelim_update(&session->glitch_ratelim, nghttp2_time_now_sec());
-
-  if (nghttp2_ratelim_drain(&session->glitch_ratelim, 1) == 0) {
-    return 0;
-  }
-
-  return nghttp2_session_terminate_session(session, NGHTTP2_ENHANCE_YOUR_CALM);
-}
-
 static int session_handle_invalid_stream2(nghttp2_session *session,
                                           int32_t stream_id,
                                           nghttp2_frame *frame,
                                           int lib_error_code) {
   int rv;
-
   rv = nghttp2_session_add_rst_stream(
     session, stream_id, get_error_code_from_lib_error_code(lib_error_code));
   if (rv != 0) {
     return rv;
   }
-  if (frame && session->callbacks.on_invalid_frame_recv_callback) {
+  if (session->callbacks.on_invalid_frame_recv_callback) {
     if (session->callbacks.on_invalid_frame_recv_callback(
           session, frame, lib_error_code, session->user_data) != 0) {
       return NGHTTP2_ERR_CALLBACK_FAILURE;
@@ -3569,29 +3539,7 @@ static int inflate_header_block(nghttp2_session *session, nghttp2_frame *frame,
 
             rv2 = session_call_on_invalid_header(session, frame, &nv);
             if (rv2 == NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE) {
-              DEBUGF("recv: HTTP error: type=%u, id=%d, header %.*s: %.*s\n",
-                     frame->hd.type, frame->hd.stream_id, (int)nv.name->len,
-                     nv.name->base, (int)nv.value->len, nv.value->base);
-
-              rv = session_call_error_callback(
-                session, NGHTTP2_ERR_HTTP_HEADER,
-                "Invalid HTTP header field was received: frame type: "
-                "%u, stream: %d, name: [%.*s], value: [%.*s]",
-                frame->hd.type, frame->hd.stream_id, (int)nv.name->len,
-                nv.name->base, (int)nv.value->len, nv.value->base);
-
-              if (nghttp2_is_fatal(rv)) {
-                return rv;
-              }
-
-              rv = session_handle_invalid_stream2(
-                session, subject_stream->stream_id, frame,
-                NGHTTP2_ERR_HTTP_HEADER);
-              if (nghttp2_is_fatal(rv)) {
-                return rv;
-              }
-
-              return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
+              rv = NGHTTP2_ERR_HTTP_HEADER;
             } else {
               if (rv2 != 0) {
                 return rv2;
@@ -3631,8 +3579,13 @@ static int inflate_header_block(nghttp2_session *session, nghttp2_frame *frame,
               return rv;
             }
 
-            return nghttp2_session_terminate_session(session,
-                                                     NGHTTP2_PROTOCOL_ERROR);
+            rv =
+              session_handle_invalid_stream2(session, subject_stream->stream_id,
+                                             frame, NGHTTP2_ERR_HTTP_HEADER);
+            if (nghttp2_is_fatal(rv)) {
+              return rv;
+            }
+            return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
           }
         }
         if (rv == 0) {
@@ -3745,7 +3698,27 @@ static int session_after_header_block_received(nghttp2_session *session) {
       }
     }
     if (rv != 0) {
-      return nghttp2_session_terminate_session(session, NGHTTP2_PROTOCOL_ERROR);
+      int32_t stream_id;
+
+      if (frame->hd.type == NGHTTP2_PUSH_PROMISE) {
+        stream_id = frame->push_promise.promised_stream_id;
+      } else {
+        stream_id = frame->hd.stream_id;
+      }
+
+      rv = session_handle_invalid_stream2(session, stream_id, frame,
+                                          NGHTTP2_ERR_HTTP_MESSAGING);
+      if (nghttp2_is_fatal(rv)) {
+        return rv;
+      }
+
+      if (frame->hd.type == NGHTTP2_HEADERS &&
+          (frame->hd.flags & NGHTTP2_FLAG_END_STREAM)) {
+        nghttp2_stream_shutdown(stream, NGHTTP2_SHUT_RD);
+        /* Don't call nghttp2_session_close_stream_if_shut_rdwr
+           because RST_STREAM has been submitted. */
+      }
+      return 0;
     }
   }
 
@@ -4081,7 +4054,8 @@ static int update_remote_initial_window_size_func(void *entry, void *ptr) {
   rv = nghttp2_stream_update_remote_initial_window_size(
     stream, arg->new_window_size, arg->old_window_size);
   if (rv != 0) {
-    return NGHTTP2_ERR_FLOW_CONTROL;
+    return nghttp2_session_add_rst_stream(arg->session, stream->stream_id,
+                                          NGHTTP2_FLOW_CONTROL_ERROR);
   }
 
   /* If window size gets positive, push deferred DATA frame to
@@ -4107,8 +4081,6 @@ static int update_remote_initial_window_size_func(void *entry, void *ptr) {
  *
  * NGHTTP2_ERR_NOMEM
  *     Out of memory.
- * NGHTTP2_ERR_FLOW_CONTROL
- *     Window size gets out of range.
  */
 static int
 session_update_remote_initial_window_size(nghttp2_session *session,
@@ -4132,7 +4104,8 @@ static int update_local_initial_window_size_func(void *entry, void *ptr) {
   rv = nghttp2_stream_update_local_initial_window_size(
     stream, arg->new_window_size, arg->old_window_size);
   if (rv != 0) {
-    return NGHTTP2_ERR_FLOW_CONTROL;
+    return nghttp2_session_add_rst_stream(arg->session, stream->stream_id,
+                                          NGHTTP2_FLOW_CONTROL_ERROR);
   }
 
   if (stream->window_update_queued) {
@@ -4166,8 +4139,6 @@ static int update_local_initial_window_size_func(void *entry, void *ptr) {
  *
  * NGHTTP2_ERR_NOMEM
  *     Out of memory.
- * NGHTTP2_ERR_FLOW_CONTROL
- *     Window size gets out of range.
  */
 static int
 session_update_local_initial_window_size(nghttp2_session *session,
@@ -4554,9 +4525,9 @@ int nghttp2_session_on_push_promise_received(nghttp2_session *session,
         session->max_incoming_reserved_streams) {
     /* Currently, client does not retain closed stream, so we don't
        check NGHTTP2_SHUT_RD condition here. */
-    rv = session_handle_invalid_stream2(session,
-                                        frame->push_promise.promised_stream_id,
-                                        NULL, NGHTTP2_ERR_PUSH_CANCEL);
+
+    rv = nghttp2_session_add_rst_stream(
+      session, frame->push_promise.promised_stream_id, NGHTTP2_CANCEL);
     if (rv != 0) {
       return rv;
     }
@@ -4713,9 +4684,8 @@ static int session_on_stream_window_update_received(nghttp2_session *session,
   }
   if (NGHTTP2_MAX_WINDOW_SIZE - frame->window_update.window_size_increment <
       stream->remote_window_size) {
-    return session_handle_invalid_connection(
-      session, frame, NGHTTP2_ERR_FLOW_CONTROL,
-      "WINDOW_UPDATE: window size overflow");
+    return session_handle_invalid_stream(session, frame,
+                                         NGHTTP2_ERR_FLOW_CONTROL);
   }
   stream->remote_window_size += frame->window_update.window_size_increment;
 
@@ -4945,7 +4915,16 @@ int nghttp2_session_on_data_received(nghttp2_session *session,
   if (session_enforce_http_messaging(session) &&
       (frame->hd.flags & NGHTTP2_FLAG_END_STREAM)) {
     if (nghttp2_http_on_remote_end_stream(stream) != 0) {
-      return nghttp2_session_terminate_session(session, NGHTTP2_PROTOCOL_ERROR);
+      rv = nghttp2_session_add_rst_stream(session, stream->stream_id,
+                                          NGHTTP2_PROTOCOL_ERROR);
+      if (nghttp2_is_fatal(rv)) {
+        return rv;
+      }
+
+      nghttp2_stream_shutdown(stream, NGHTTP2_SHUT_RD);
+      /* Don't call nghttp2_session_close_stream_if_shut_rdwr because
+         RST_STREAM has been submitted. */
+      return 0;
     }
   }
 
@@ -5003,8 +4982,8 @@ int nghttp2_session_update_recv_stream_window_size(nghttp2_session *session,
   rv = adjust_recv_window_size(&stream->recv_window_size, delta_size,
                                stream->local_window_size);
   if (rv != 0) {
-    return nghttp2_session_terminate_session(session,
-                                             NGHTTP2_FLOW_CONTROL_ERROR);
+    return nghttp2_session_add_rst_stream(session, stream->stream_id,
+                                          NGHTTP2_FLOW_CONTROL_ERROR);
   }
   /* We don't have to send WINDOW_UPDATE if the data received is the
      last chunk in the incoming stream. */
@@ -5472,16 +5451,6 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
         if (rv == NGHTTP2_ERR_IGN_PAYLOAD) {
           DEBUGF("recv: DATA not allowed stream_id=%d\n",
                  iframe->frame.hd.stream_id);
-
-          rv = session_update_glitch_ratelim(session);
-          if (rv != 0) {
-            return rv;
-          }
-
-          if (iframe->state == NGHTTP2_IB_IGN_ALL) {
-            return (nghttp2_ssize)inlen;
-          }
-
           iframe->state = NGHTTP2_IB_IGN_DATA;
           break;
         }
@@ -5507,20 +5476,6 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
           break;
         }
 
-        /* Empty DATA frame without END_STREAM flag set is
-           suspicious. */
-        if (iframe->payloadleft == 0 &&
-            (iframe->frame.hd.flags & NGHTTP2_FLAG_END_STREAM) == 0) {
-          rv = session_update_glitch_ratelim(session);
-          if (rv != 0) {
-            return rv;
-          }
-
-          if (iframe->state == NGHTTP2_IB_IGN_ALL) {
-            return (nghttp2_ssize)inlen;
-          }
-        }
-
         iframe->state = NGHTTP2_IB_READ_DATA;
         break;
       }
@@ -5587,8 +5542,8 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
         }
 
         if (rv == NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE) {
-          rv = session_handle_invalid_stream2(
-            session, iframe->frame.hd.stream_id, NULL, NGHTTP2_ERR_INTERNAL);
+          rv = nghttp2_session_add_rst_stream(
+            session, iframe->frame.hd.stream_id, NGHTTP2_INTERNAL_ERROR);
           if (nghttp2_is_fatal(rv)) {
             return rv;
           }
@@ -5597,15 +5552,6 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
         }
 
         if (rv == NGHTTP2_ERR_IGN_HEADER_BLOCK) {
-          rv = session_update_glitch_ratelim(session);
-          if (rv != 0) {
-            return rv;
-          }
-
-          if (iframe->state == NGHTTP2_IB_IGN_ALL) {
-            return (nghttp2_ssize)inlen;
-          }
-
           iframe->state = NGHTTP2_IB_IGN_HEADER_BLOCK;
           break;
         }
@@ -5626,18 +5572,6 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
           break;
         }
 
-        /* This is deprecated RFC 7540 priorities mechanism which is
-           very unpopular.  We do not expect it is received so
-           frequently. */
-        rv = session_update_glitch_ratelim(session);
-        if (rv != 0) {
-          return rv;
-        }
-
-        if (iframe->state == NGHTTP2_IB_IGN_ALL) {
-          return (nghttp2_ssize)inlen;
-        }
-
         iframe->state = NGHTTP2_IB_READ_NBYTE;
 
         inbound_frame_set_mark(iframe, NGHTTP2_PRIORITY_SPECLEN);
@@ -5810,17 +5744,8 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
         if (check_ext_type_set(session->user_recv_ext_types,
                                iframe->frame.hd.type)) {
           if (!session->callbacks.unpack_extension_callback) {
-            /* Receiving too frequent unknown frames is suspicious. */
-            rv = session_update_glitch_ratelim(session);
-            if (rv != 0) {
-              return rv;
-            }
-
-            if (iframe->state == NGHTTP2_IB_IGN_ALL) {
-              return (nghttp2_ssize)inlen;
-            }
-
             /* Silently ignore unknown frame type. */
+
             busy = 1;
 
             iframe->state = NGHTTP2_IB_IGN_PAYLOAD;
@@ -5932,17 +5857,6 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
               break;
             }
 
-            /* Receiving too frequent PRIORITY_UPDATE is
-               suspicious. */
-            rv = session_update_glitch_ratelim(session);
-            if (rv != 0) {
-              return rv;
-            }
-
-            if (iframe->state == NGHTTP2_IB_IGN_ALL) {
-              return (nghttp2_ssize)inlen;
-            }
-
             if (iframe->payloadleft > sizeof(iframe->raw_sbuf)) {
               busy = 1;
               iframe->state = NGHTTP2_IB_IGN_PAYLOAD;
@@ -5956,16 +5870,6 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
 
             break;
           default:
-            /* Receiving too frequent unknown frames is suspicious. */
-            rv = session_update_glitch_ratelim(session);
-            if (rv != 0) {
-              return rv;
-            }
-
-            if (iframe->state == NGHTTP2_IB_IGN_ALL) {
-              return (nghttp2_ssize)inlen;
-            }
-
             busy = 1;
 
             iframe->state = NGHTTP2_IB_IGN_PAYLOAD;
@@ -6052,8 +5956,8 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
         }
 
         if (rv == NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE) {
-          rv = session_handle_invalid_stream2(
-            session, iframe->frame.hd.stream_id, NULL, NGHTTP2_ERR_INTERNAL);
+          rv = nghttp2_session_add_rst_stream(
+            session, iframe->frame.hd.stream_id, NGHTTP2_INTERNAL_ERROR);
           if (nghttp2_is_fatal(rv)) {
             return rv;
           }
@@ -6062,15 +5966,6 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
         }
 
         if (rv == NGHTTP2_ERR_IGN_HEADER_BLOCK) {
-          rv = session_update_glitch_ratelim(session);
-          if (rv != 0) {
-            return rv;
-          }
-
-          if (iframe->state == NGHTTP2_IB_IGN_ALL) {
-            return (nghttp2_ssize)inlen;
-          }
-
           iframe->state = NGHTTP2_IB_IGN_HEADER_BLOCK;
           break;
         }
@@ -6136,9 +6031,9 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
         }
 
         if (rv == NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE) {
-          rv = session_handle_invalid_stream2(
-            session, iframe->frame.push_promise.promised_stream_id, NULL,
-            NGHTTP2_ERR_INTERNAL);
+          rv = nghttp2_session_add_rst_stream(
+            session, iframe->frame.push_promise.promised_stream_id,
+            NGHTTP2_INTERNAL_ERROR);
           if (nghttp2_is_fatal(rv)) {
             return rv;
           }
@@ -6316,12 +6211,12 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
           iframe->payloadleft -= hd_proclen;
 
           /* Use promised stream ID for PUSH_PROMISE */
-          rv = session_handle_invalid_stream2(
+          rv = nghttp2_session_add_rst_stream(
             session,
             iframe->frame.hd.type == NGHTTP2_PUSH_PROMISE
               ? iframe->frame.push_promise.promised_stream_id
               : iframe->frame.hd.stream_id,
-            NULL, NGHTTP2_ERR_INTERNAL);
+            NGHTTP2_INTERNAL_ERROR);
           if (nghttp2_is_fatal(rv)) {
             return rv;
           }
@@ -6368,10 +6263,6 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
           if (nghttp2_is_fatal(rv)) {
             return rv;
           }
-
-          if (iframe->state == NGHTTP2_IB_IGN_ALL) {
-            return (nghttp2_ssize)inlen;
-          }
         }
         session_inbound_frame_reset(session);
 
@@ -6597,10 +6488,6 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
         if (nghttp2_is_fatal(rv)) {
           return rv;
         }
-
-        if (iframe->state == NGHTTP2_IB_IGN_ALL) {
-          return (nghttp2_ssize)inlen;
-        }
       }
 
       busy = 1;
@@ -6617,20 +6504,6 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
 
       iframe->frame.data.padlen = (size_t)padlen;
 
-      /* Empty DATA frame without END_STREAM flag set is
-         suspicious. */
-      if (iframe->payloadleft == 0 &&
-          (iframe->frame.hd.flags & NGHTTP2_FLAG_END_STREAM) == 0) {
-        rv = session_update_glitch_ratelim(session);
-        if (rv != 0) {
-          return rv;
-        }
-
-        if (iframe->state == NGHTTP2_IB_IGN_ALL) {
-          return (nghttp2_ssize)inlen;
-        }
-      }
-
       iframe->state = NGHTTP2_IB_READ_DATA;
 
       break;
@@ -6673,10 +6546,6 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
           return rv;
         }
 
-        if (iframe->state == NGHTTP2_IB_IGN_ALL) {
-          return (nghttp2_ssize)inlen;
-        }
-
         data_readlen =
           inbound_frame_effective_readlen(iframe, iframe->payloadleft, readlen);
 
@@ -6706,13 +6575,28 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
         if (data_readlen > 0) {
           if (session_enforce_http_messaging(session)) {
             if (nghttp2_http_on_data_chunk(stream, (size_t)data_readlen) != 0) {
-              rv = nghttp2_session_terminate_session(session,
-                                                     NGHTTP2_PROTOCOL_ERROR);
+              if (session->opt_flags & NGHTTP2_OPTMASK_NO_AUTO_WINDOW_UPDATE) {
+                /* Consume all data for connection immediately here */
+                rv = session_update_connection_consumed_size(
+                  session, (size_t)data_readlen);
+
+                if (nghttp2_is_fatal(rv)) {
+                  return rv;
+                }
+
+                if (iframe->state == NGHTTP2_IB_IGN_DATA) {
+                  return (nghttp2_ssize)inlen;
+                }
+              }
+
+              rv = nghttp2_session_add_rst_stream(
+                session, iframe->frame.hd.stream_id, NGHTTP2_PROTOCOL_ERROR);
               if (nghttp2_is_fatal(rv)) {
                 return rv;
               }
-
-              return (nghttp2_ssize)inlen;
+              busy = 1;
+              iframe->state = NGHTTP2_IB_IGN_DATA;
+              break;
             }
           }
           if (session->callbacks.on_data_chunk_recv_callback) {
@@ -6739,10 +6623,6 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
         return rv;
       }
 
-      if (iframe->state == NGHTTP2_IB_IGN_ALL) {
-        return (nghttp2_ssize)inlen;
-      }
-
       session_inbound_frame_reset(session);
 
       break;
diff --git a/deps/nghttp2/lib/nghttp2_session.h b/deps/nghttp2/lib/nghttp2_session.h
index 25f300d23f1..419d23b5a96 100644
--- a/deps/nghttp2/lib/nghttp2_session.h
+++ b/deps/nghttp2/lib/nghttp2_session.h
@@ -106,10 +106,6 @@ typedef struct {
 #define NGHTTP2_DEFAULT_STREAM_RESET_BURST 1000
 #define NGHTTP2_DEFAULT_STREAM_RESET_RATE 33
 
-/* The default values for glitch rate limiter. */
-#define NGHTTP2_DEFAULT_GLITCH_BURST 1000
-#define NGHTTP2_DEFAULT_GLITCH_RATE 33
-
 /* The default max number of CONTINUATION frames following an incoming
    HEADER frame. */
 #define NGHTTP2_DEFAULT_MAX_CONTINUATIONS 8
@@ -233,8 +229,6 @@ struct nghttp2_session {
   /* Stream reset rate limiter.  If receiving excessive amount of
      stream resets, GOAWAY will be sent. */
   nghttp2_ratelim stream_reset_ratelim;
-  /* Rate limiter for all kinds of glitches. */
-  nghttp2_ratelim glitch_ratelim;
   /* Sequential number across all streams to process streams in
      FIFO. */
   uint64_t stream_seq;
diff --git a/deps/nghttp2/lib/nghttp2_submit.c b/deps/nghttp2/lib/nghttp2_submit.c
index 8a90f714e4a..5c6390fa759 100644
--- a/deps/nghttp2/lib/nghttp2_submit.c
+++ b/deps/nghttp2/lib/nghttp2_submit.c
@@ -487,7 +487,7 @@ int nghttp2_submit_altsvc(nghttp2_session *session, uint8_t flags,
   return 0;
 
 fail_item_malloc:
-  nghttp2_mem_free(mem, buf);
+  free(buf);
 
   return rv;
 }
@@ -570,7 +570,7 @@ int nghttp2_submit_origin(nghttp2_session *session, uint8_t flags,
   return 0;
 
 fail_item_malloc:
-  nghttp2_mem_free(mem, ov_copy);
+  free(ov_copy);
 
   return rv;
 }
@@ -642,7 +642,7 @@ int nghttp2_submit_priority_update(nghttp2_session *session, uint8_t flags,
   return 0;
 
 fail_item_malloc:
-  nghttp2_mem_free(mem, buf);
+  free(buf);
 
   return rv;
 }

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/70104/

[trivikr]

Reverting nghttp2/nghttp2@7784fa9 makes the tests pass.

Is this issue with nghttp2 itself, or the way Node.js uses it?

• If it's former, is there a report upstream? If not, should we create one?
• If it's latter, do we need to apply it with each version update? Or search for a fix outside of deps folder?

[aduh95]

IMO it’s a breaking change upstream (by definition), which we should not expect in a semver-minor. In terms of reporting, the only thing I’ve done is posting nghttp2/nghttp2#2480 (comment). In any case, if it is not reverted upstream, the only options we have is to adapt, float the revert, or stay behind.

[aduh95]

Landed in bd3a202...408aba6