🎯 New Report #3564941: HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser
🔺Severity: Low
👽 Reporter: yushengchen
⭐️ Reputation: 151
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-02-20
⏰ Disclosed: 2026-08-28 14:16:19
📝 Summary: A flaw in the Node.js HTTP client was discovered that could cause a request desynchronization for Node.js-based forwarding proxies. The issue was caused by the Node.js HTTP parser omitting headers beyond the configured limit from the visible request headers, while still using those headers internally for HTTP message framing. This vulnerability was found to affect all supported Node.js release lines.
📂 Report JSON File: 3564941
@hackeronereports