From b5408ed0078aacf879eeae8d4348401497822696 Mon Sep 17 00:00:00 2001
From: Matteo Collina <hello@matteocollina.com>
Date: Tue, 14 Jul 2026 09:32:16 +0200
Subject: [PATCH] http2: reject unsupported ALPN protocols

Signed-off-by: Matteo Collina <hello@matteocollina.com>
---
 doc/api/http2.md                 | 13 ++++++++++---
 lib/internal/http2/core.js       |  6 ++++--
 test/parallel/test-http2-alpn.js |  9 +++++++--
 3 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/doc/api/http2.md b/doc/api/http2.md
index 1003fb3fb0e90e..5b7d72f69d26af 100644
--- a/doc/api/http2.md
+++ b/doc/api/http2.md
@@ -2732,6 +2732,10 @@ a given number of milliseconds set using `http2secureServer.setTimeout()`.
 <!-- YAML
 added: v8.4.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64493
+    description: The event is emitted when a custom `ALPNCallback` selects an
+                 unsupported protocol.
   - version: v19.0.0
     pr-url: https://github.com/nodejs/node/pull/44031
     description: This event will only be emitted if the client did not transmit
@@ -2750,9 +2754,12 @@ In earlier versions of Node.js, this event would be emitted if `allowHTTP1` is
 `false` and, during the TLS handshake, the client either does not send an ALPN
 extension or sends an ALPN extension that does not include HTTP/2 (`h2`). Newer
 versions of Node.js only emit this event if `allowHTTP1` is `false` and the
-client does not send an ALPN extension. If the client sends an ALPN extension
-that does not include HTTP/2 (or HTTP/1.1 if `allowHTTP1` is `true`), the TLS
-handshake will fail and no secure connection will be established.
+client does not send an ALPN extension. The event is also emitted when a custom
+`ALPNCallback` selects a protocol other than `h2` (or `http/1.1` when
+`allowHTTP1` is `true`). With the default ALPN configuration, if the client
+sends an ALPN extension that does not include HTTP/2 (or HTTP/1.1 if
+`allowHTTP1` is `true`), the TLS handshake will fail and no secure connection
+will be established.
 
 See the [Compatibility API][].
 
diff --git a/lib/internal/http2/core.js b/lib/internal/http2/core.js
index 0691b4aabfc81b..724807cf0b00c3 100644
--- a/lib/internal/http2/core.js
+++ b/lib/internal/http2/core.js
@@ -3523,9 +3523,11 @@ function connectionListener(socket) {
   debug('Http2Session server: received a connection');
   const options = this[kOptions] || {};
 
-  if (socket.alpnProtocol === false || socket.alpnProtocol === 'http/1.1') {
+  if (socket.alpnProtocol !== undefined && socket.alpnProtocol !== 'h2') {
     // Fallback to HTTP/1.1
-    if (options.allowHTTP1 === true) {
+    if (options.allowHTTP1 === true &&
+        (socket.alpnProtocol === false ||
+         socket.alpnProtocol === 'http/1.1')) {
       return httpConnectionListener.call(this, socket);
     }
     // Let event handler deal with the socket
diff --git a/test/parallel/test-http2-alpn.js b/test/parallel/test-http2-alpn.js
index 3f618d7cc83b94..ccf721612e370d 100644
--- a/test/parallel/test-http2-alpn.js
+++ b/test/parallel/test-http2-alpn.js
@@ -18,20 +18,25 @@ const tls = require('tls');
   }), (error) => error.code === 'ERR_TLS_ALPN_CALLBACK_WITH_PROTOCOLS');
 }
 
-{
+for (const allowHTTP1 of [false, true]) {
   const server = h2.createSecureServer({
     key: fixtures.readKey('rsa_private.pem'),
     cert: fixtures.readKey('rsa_cert.crt'),
     ALPNCallback: () => 'a',
+    allowHTTP1,
   });
 
+  server.on('unknownProtocol', common.mustCall((socket) => {
+    assert.strictEqual(socket.alpnProtocol, 'a');
+  }));
+  server.on('session', common.mustNotCall());
   server.on(
     'secureConnection',
     common.mustCall((socket) => {
       assert.strictEqual(socket.alpnProtocol, 'a');
       socket.end();
       server.close();
-    })
+    }),
   );
 
   server.listen(0, common.mustCall(() => {