TGViewer
Sys-Admin InfoSec Sys-Admin InfoSec @sysadm_in_channel · 12.9K subscribers
Post #5449 3.19K

Forwarded from Sys-Admin Up (Yevgeniy Goncharov)

The Forgotten Bug: How a Node.js Core Design Flaw Enables HTTP Request Splitting

https://r3verii.github.io/cve/2026/02/27/nodejs-toctou.html
CyberSec Notes The Forgotten Bug: How a Node.js Core Design Flaw Enables HTTP Request Splitting Deep dive into a TOCTOU vulnerability in Node.js’s ClientRequest.path that bypasses CRLF validation and enables Header Injection and HTTP Request Splitting across 7+ major HTTP libraries totaling 160M+ weekly downloads.
Open in Telegram All posts from @sysadm_in_channel
More from @sysadm_in_channel
  1. Sep 15, 2026Open SysConf'26 - Доклад: поиск уязвимостей в эпоху AI Кибербезопасность, AI - сегодня иду…
  2. Sep 11, 2026An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation injecting backdoor in to terra…
  3. Sep 9, 2026Threat Spotlight: Phishing pages that exist only inside the victim’s browser https://blog.…
  4. Sep 7, 2026Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate upda…
  5. Sep 4, 2026Post #5494
  6. Sep 3, 2026ChatGPT Is Throwing 404
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →