● Node.js Advisory · September 2026

Node.js Security Advisory: September 2026 llhttp Smuggling Triage

Triage of the coordinated September 2026 Node.js release patching critical HTTP request smuggling in llhttp across v18, v20, and v22.

6
Core CVEs Resolved
1
HTTP Request Smuggling
8.2
CVSS llhttp Flaw
Immediate
Production Server Priority

漏洞风险分类与修复裁决

The OpenJS Foundation released security updates for Node.js addressing CVE-2024-27983 in the llhttp parser. Incomplete validation of Transfer-Encoding headers allowed reverse-proxy cache poisoning and credential hijacking.

重点漏洞分类评级矩阵

CVE 编号 核心子系统 / 组件 影响程度 CVSS 是否在野利用？
CVE-2024-27983llhttp HTTP ParserHTTP Request Smuggling8.2 HighYES (In-The-Wild)
CVE-2024-27982HTTP/2 Stream ResetDenial of Service7.5 HighNo
CVE-2024-27981Inspector ProtocolWebSocket Hijack6.5 MediumNo
深度源码剖析

Deep Dive: Node.js llhttp HTTP Request Smuggling Teardown →

Examine the C parser state machine diff in deps/llhttp strictly rejecting malformed Transfer-Encoding chunk extensions.

← 浏览完整安全目录 所有平台安全更新 →