Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nodejs (UTSA-2026-150093)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150093 advisory. The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nodejs (UTSA-2026-150106)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150106 advisory. The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nodejs (UTSA-2026-150119)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150119 advisory. The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request...

CLEANSTART-2025-OC60985 llhttp parser in the http module in Node v18

CVE-2022-35256 affects multiple packages. The llhttp parser in the http module in Node v18. See references for individual vulnerability details...

CLEANSTART-2025-AE12013 llhttp parser <v14

CVE-2022-32215 affects multiple packages. The llhttp parser v14. See references for individual vulnerability details...

CLEANSTART-2025-QP76380 llhttp parser <v14

CVE-2022-32214 affects multiple packages. The llhttp parser v14. See references for individual vulnerability details...

CLEANSTART-2026-LT90473 parse function in llhttp < 2

Security vulnerability affects the nodejs-24 package. The parse function in llhttp 2...

CLEANSTART-2026-GA51993 llhttp parser in the http module in Node v18

Security vulnerability affects the nodejs-24 package. The llhttp parser in the http module in Node v18...

CLEANSTART-2026-NF09722 llhttp parser <v14

Security vulnerability affects the nodejs-24 package. The llhttp parser v14...

CLEANSTART-2026-TQ27945 llhttp parser <v14

Security vulnerability affects the nodejs-24 package. The llhttp parser v14...

CLEANSTART-2026-XP35596 llhttp parser <v14

Security vulnerability affects the nodejs-24 package. The llhttp parser v14...

CLEANSTART-2026-LJ66214 llhttp parser in the http module in Node v20

Security vulnerability affects the openjdk17 package. The llhttp parser in the http module in Node v20...

PT-2026-122327

Security vulnerability affects the openjdk17 package. The llhttp parser in the http module in Node v20...

SUSE-SU-2026:4355-1 Security update for nodejs16

This update for nodejs16 fixes the following issues: - CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification bsc1236250. - CVE-2025-23166: improper error handling in async cryptographic operations crashes process bsc1243218. - CVE-2025-23167:...

CVE-2026-69244

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...

llhttp HTTP Client Arbitrary Header Bypass

The vulnerability in the llhttp HTTP client for aiohttp relates to improper handling of CRLF sequences in HTTP headers when processing the reason parameter. Exploitation of this vulnerability enables a remote attacker to inject arbitrary HTTP headers and bypass existing security restrictions...

Node.js: HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parser

A vulnerability was discovered in the Node.js HTTP server where it ignores the "Connection: close" header when the token is followed by a tab character. This allows an attacker to send a second request on the same connection, even after the first request should have closed the connection...

Header Injection

aiohttp is vulnerable to Header Injection. The vulnerability is due to the C parser llhttp accepting null bytes and control characters in response header values, where crafted header values containing these characters can be interpreted differently by the application or downstream proxies,...

Node.js: Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status Line

The llhttp HTTP response parser in Node.js up to version 24.14.1 llhttp v9.3.0 and v9.3.1 was found to unconditionally accept a bare carriage return CR as a valid response status line terminator. This parsing asymmetry was present in the response path but not in the request parsing, enabling...

GHSA-63HF-3VF5-4WQF AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

Summary The C parser the default for most installs accepted null bytes and control characters in request headers. Impact An attacker could send header values that are interpreted differently than expected due to the presence of control characters. For example, request.url.origin may return a...