● Node.js Advisory · September 2026

Node.js Security Advisory: September 2026 llhttp Smuggling Triage

Triage of the coordinated September 2026 Node.js release patching critical HTTP request smuggling in llhttp across v18, v20, and v22.

6
Core CVEs Resolved
1
HTTP Request Smuggling
8.2
CVSS llhttp Flaw
Immediate
Production Server Priority

보안 릴리스 분석 및 위험성 평가

The OpenJS Foundation released security updates for Node.js addressing CVE-2024-27983 in the llhttp parser. Incomplete validation of Transfer-Encoding headers allowed reverse-proxy cache poisoning and credential hijacking.

핵심 취약점 트리아지 매트릭스

CVE 식별자 서브시스템 / 구성 요소 영향 CVSS 실제 악용 여부?
CVE-2024-27983llhttp HTTP ParserHTTP Request Smuggling8.2 HighYES (In-The-Wild)
CVE-2024-27982HTTP/2 Stream ResetDenial of Service7.5 HighNo
CVE-2024-27981Inspector ProtocolWebSocket Hijack6.5 MediumNo
주목할 코드 분석

Deep Dive: Node.js llhttp HTTP Request Smuggling Teardown →

Examine the C parser state machine diff in deps/llhttp strictly rejecting malformed Transfer-Encoding chunk extensions.

← 전체 보안 디렉터리 보기 모든 플랫폼 보안 업데이트 →