node:http: bound the header count with the engine's min, not the live Math.min

src/js/node/_http_common.ts

@@ -122,7 +122,7 @@ function parserOnHeadersComplete(
 
   // If parser.maxHeaderPairs <= 0 assume that there's no limit.
   const maxHeaderPairs = parser.maxHeaderPairs;
-  if (maxHeaderPairs > 0) n = Math.min(n, maxHeaderPairs);
+  if (maxHeaderPairs > 0) n = $min(n, maxHeaderPairs);
 
   incoming._addHeaderLines(headers, n);
 

test/js/node/http/node-http-primoridals.test.ts

@@ -1,4 +1,5 @@
 import { afterEach, expect, test } from "bun:test";
+import { bunEnv, bunExe } from "harness";
 
 const Response = globalThis.Response;
 const Request = globalThis.Request;
@@ -128,3 +129,44 @@ test("Overriding Request, Response, Headers, and Blob should not break node:http
     globalThis.Blob = Blob;
   }
 });
+
+// The response header count is bounded with the engine's own min(), so a
+// user-patched Math.min cannot make IncomingMessage read past the flat
+// [name, value, ...] header array.
+test("a patched Math.min does not reach IncomingMessage header parsing", async () => {
+  await using proc = Bun.spawn({
+    cmd: [
+      bunExe(),
+      "-e",
+      `
+      const http = require("http");
+      const server = http.createServer((req, res) => {
+        res.setHeader("x-server", "1");
+        res.end("ok");
+      });
+      server.listen(0, "127.0.0.1", () => {
+        const origMin = Math.min;
+        Math.min = (...args) => origMin(...args) + 1;
+        process.on("uncaughtException", err => {
+          console.log("UNCAUGHT:", err.message);
+          process.exit(1);
+        });
+        http.get({ host: "127.0.0.1", port: server.address().port, headers: { "x-h": "v" } }, res => {
+          res.resume();
+          res.on("end", () => {
+            Math.min = origMin;
+            console.log("client: got", res.statusCode, res.headers["x-server"]);
+            server.close();
+          });
+        });
+      });
+      `,
+    ],
+    env: bunEnv,
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  expect(stdout).toBe("client: got 200 1\n");
+  expect(stderr).toBe("");
+  expect(exitCode).toBe(0);
+});