🎯 New Report #3723248: HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parser
🔺Severity: Medium
👽 Reporter: nadav0077
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-05-09
⏰ Disclosed: 2026-07-31 15:27:19
📝 Summary: A vulnerability was discovered in the Node.js HTTP server where it ignores the "Connection: close" header when the token is followed by a tab character. This allows an attacker to send a second request on the same connection, even after the first request should have closed the connection.
📂 Report JSON File: 3723248
@hackeronereports