CLEANSTART-2025-OC60985 llhttp parser in the http module in Node v18

CVE-2022-35256 affects multiple packages. The llhttp parser in the http module in Node v18. See references for individual vulnerability details...

CLEANSTART-2025-AE12013 llhttp parser <v14

CVE-2022-32215 affects multiple packages. The llhttp parser v14. See references for individual vulnerability details...

CLEANSTART-2025-QP76380 llhttp parser <v14

CVE-2022-32214 affects multiple packages. The llhttp parser v14. See references for individual vulnerability details...

CLEANSTART-2026-GA51993 llhttp parser in the http module in Node v18

Security vulnerability affects the nodejs-24 package. The llhttp parser in the http module in Node v18...

CLEANSTART-2026-NF09722 llhttp parser <v14

Security vulnerability affects the nodejs-24 package. The llhttp parser v14...

CLEANSTART-2026-TQ27945 llhttp parser <v14

Security vulnerability affects the nodejs-24 package. The llhttp parser v14...

CLEANSTART-2026-XP35596 llhttp parser <v14

Security vulnerability affects the nodejs-24 package. The llhttp parser v14...

CLEANSTART-2026-LJ66214 llhttp parser in the http module in Node v20

Security vulnerability affects the openjdk17 package. The llhttp parser in the http module in Node v20...

PT-2026-122327

Security vulnerability affects the openjdk17 package. The llhttp parser in the http module in Node v20...

Node.js: HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parser

A vulnerability was discovered in the Node.js HTTP server where it ignores the "Connection: close" header when the token is followed by a tab character. This allows an attacker to send a second request on the same connection, even after the first request should have closed the connection...

Header Injection

aiohttp is vulnerable to Header Injection. The vulnerability is due to the C parser llhttp accepting null bytes and control characters in response header values, where crafted header values containing these characters can be interpreted differently by the application or downstream proxies,...

CVE-2026-34520

The aiohttp asynchronous HTTP client/server framework for Python and asyncio is vulnerable to a security bypass and header injection due to a flaw in its C parser (the default for most installations). Specifically, the parser accepts null bytes and control characters in response headers, allowing...

EUVD-2023-2033

Malicious code in bioql PyPI...

EUVD-2022-38147

Malicious code in bioql PyPI...

BIT-NODE-MIN-2022-32213

The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling HRS...

BIT-NODE-MIN-2022-32214

The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS...

BIT-NODE-MIN-2022-32215

The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling HRS...

BIT-NODE-MIN-2022-35256

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling...

BIT-NODE-MIN-2023-30589

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS. The CR character without LF is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only th...

python-aiohttp: HTTP request smuggling via llhttp HTTP request parser

A flaw was found in aio-libs aiohttp, where it is vulnerable to HTTP request smuggling, caused by a flaw in the aiohttp.web.Application. By sending a specially crafted HTTPS request, an attacker can poison the web cache, bypass web application firewall protection, and conduct Cross-site scripting...