doc: more accurate zlib windowBits information

Fixes: #14847
PR-URL: #16511
Backport-PR-URL: #16623
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Michael Dawson <[email protected]>
Reviewed-By: Refael Ackermann <[email protected]>

Author: addaleax

doc/api/zlib.md

@@ -423,12 +423,11 @@ added: v0.5.8
 Returns a new [DeflateRaw][] object with an [options][].
 
 *Note*: An upgrade of zlib from 1.2.8 to 1.2.11 changed behavior when windowBits
-is set to 8 for raw deflate streams. zlib does not have a working implementation
-of an 8-bit Window for raw deflate streams and would automatically set windowBit
-to 9 if initially set to 8. Newer versions of zlib will throw an exception.
-This creates a potential DOS vector, and as such the behavior has been reverted
-in Node.js 8, 6, and 4. Node.js version 9 and higher will throw when windowBits
-is set to 8.
+is set to 8 for raw deflate streams. zlib would automatically set windowBits
+to 9 if was initially set to 8. Newer versions of zlib will throw an exception,
+so Node.js restored the original behavior of upgrading a value of 8 to 9,
+since passing `windowBits = 9` to zlib actually results in a compressed stream
+that effectively uses an 8-bit window only.
 
 ## zlib.createGunzip([options])
 <!-- YAML

test/parallel/test-zlib.js

@@ -145,7 +145,8 @@ assert.doesNotThrow(() => {
   // value of the matching deflate’s windowBits. However, inflate raw with
   // windowBits = 8 should be able to handle compressed data from a source
   // that does not know about the silent 8-to-9 upgrade of windowBits
-  // that older versions of zlib/Node perform.
+  // that most versions of zlib/Node perform, and which *still* results in
+  // a valid 8-bit-window zlib stream.
   node.pipe(zlib.createDeflateRaw({ windowBits: 9 }))
       .pipe(zlib.createInflateRaw({ windowBits: 8 }))
       .on('data', (chunk) => reinflated.push(chunk))