CVE-2026-66731

facil.io 0.7.5–0.7.6 contains a remote DoS in the HTTP/1.1 chunked transfer encoding parser. The vulnerability arises when a negative chunk size value is sent via a Transfer-Encoding: chunked header, causing http1_parser.h to negate the size, compute a large positive value, corrupt internal state...