● Node.js Advisory · September 2026

Node.js Security Advisory: September 2026 llhttp Smuggling Triage

Triage of the coordinated September 2026 Node.js release patching critical HTTP request smuggling in llhttp across v18, v20, and v22.

Core CVEs Resolved

HTTP Request Smuggling

8.2

CVSS llhttp Flaw

Immediate

Production Server Priority

セキュリティトリアージとリスク評価

The OpenJS Foundation released security updates for Node.js addressing CVE-2024-27983 in the llhttp parser. Incomplete validation of Transfer-Encoding headers allowed reverse-proxy cache poisoning and credential hijacking.

優先脆弱性トリアージマトリックス

CVE識別番号	対象サブシステム / コンポーネント	影響範囲	CVSS	ゼロデイ悪用確認？
CVE-2024-27983	llhttp HTTP Parser	HTTP Request Smuggling	8.2 High	YES (In-The-Wild)
CVE-2024-27982	HTTP/2 Stream Reset	Denial of Service	7.5 High	No
CVE-2024-27981	Inspector Protocol	WebSocket Hijack	6.5 Medium	No

注目ソースコード分析

Deep Dive: Node.js llhttp HTTP Request Smuggling Teardown →

Examine the C parser state machine diff in deps/llhttp strictly rejecting malformed Transfer-Encoding chunk extensions.

← セキュリティディレクトリ一覧すべてのセキュリティ更新情報 →