● Node.js Advisory · September 2026

Node.js Security Advisory: September 2026 llhttp Smuggling Triage

Triage of the coordinated September 2026 Node.js release patching critical HTTP request smuggling in llhttp across v18, v20, and v22.

6
Core CVEs Resolved
1
HTTP Request Smuggling
8.2
CVSS llhttp Flaw
Immediate
Production Server Priority

Executive Triage und Risikobewertung

The OpenJS Foundation released security updates for Node.js addressing CVE-2024-27983 in the llhttp parser. Incomplete validation of Transfer-Encoding headers allowed reverse-proxy cache poisoning and credential hijacking.

Kuratierte Schwachstellen-Triage-Matrix

CVE-Kennung Subsystem / Komponente Auswirkung CVSS Aktive Ausnutzung?
CVE-2024-27983llhttp HTTP ParserHTTP Request Smuggling8.2 HighYES (In-The-Wild)
CVE-2024-27982HTTP/2 Stream ResetDenial of Service7.5 HighNo
CVE-2024-27981Inspector ProtocolWebSocket Hijack6.5 MediumNo
HERVORGEHOBENE CODE-ANALYSE

Deep Dive: Node.js llhttp HTTP Request Smuggling Teardown →

Examine the C parser state machine diff in deps/llhttp strictly rejecting malformed Transfer-Encoding chunk extensions.

← Sicherheitsverzeichnis durchsuchen Alle Sicherheitsupdates →