🎯 New Report #3648681: Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status Line
🔺Severity: Medium
👽 Reporter: saif-01
⭐️ Reputation: 109
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-04-04
⏰ Disclosed: 2026-07-01 15:39:11
📝 Summary: The llhttp HTTP response parser in Node.js up to version 24.14.1 (llhttp v9.3.0 and v9.3.1) was found to unconditionally accept a bare carriage return (CR) as a valid response status line terminator. This parsing asymmetry was present in the response path but not in the request parsing, enabling potential HTTP response queue poisoning attacks. The vulnerability was triggered in strict mode without requiring any lenient flags.
📂 Report JSON File: 3648681
@hackeronereports