Node.js · Report #2054283

Improper HTTP header block termination in llhttp

Validstatus

mediumseverity

122upvotes

13 Jun 2025disclosed

Summary

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.

Impact:

This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original