● Node.js Advisory · September 2026

Node.js Security Advisory: September 2026 llhttp Smuggling Triage

Triage of the coordinated September 2026 Node.js release patching critical HTTP request smuggling in llhttp across v18, v20, and v22.

6
Core CVEs Resolved
1
HTTP Request Smuggling
8.2
CVSS llhttp Flaw
Immediate
Production Server Priority

Triage Exécutif et Verdict de Risque

The OpenJS Foundation released security updates for Node.js addressing CVE-2024-27983 in the llhttp parser. Incomplete validation of Transfer-Encoding headers allowed reverse-proxy cache poisoning and credential hijacking.

Matrice de Triage des Vulnérabilités

Identifiant CVE Sous-système / Composant Impact CVSS Exploitation Active ?
CVE-2024-27983llhttp HTTP ParserHTTP Request Smuggling8.2 HighYES (In-The-Wild)
CVE-2024-27982HTTP/2 Stream ResetDenial of Service7.5 HighNo
CVE-2024-27981Inspector ProtocolWebSocket Hijack6.5 MediumNo
ANALYSE DE CODE DÉTAILLÉE

Deep Dive: Node.js llhttp HTTP Request Smuggling Teardown →

Examine the C parser state machine diff in deps/llhttp strictly rejecting malformed Transfer-Encoding chunk extensions.

← Parcourir l'Annuaire de Sécurité Tous les Bulletins de Sécurité →