Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

nodejs/llhttp

              main @ 01e105a
            

Fixes

CVEs

HIGH

Peak severity

Highlights

HTTP Request Smuggling: 1 prior fix. Scrutinize any change in this area.

llhttp: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

HTTP Request Smuggling: The llhttp parser has a recurring history of failing to strictly validate HTTP protocol compliance, specifically regarding Transfer-Encoding header multi-coding, chunked extensions, and CRLF delimiter rules (e.g., CVE-2022-32213, CVE-2022-32215, and CVE-2022-32214). Failure to strictly reject invalid parser states allows attackers to manipulate downstream proxy routing.

Memory Corruption: WebAssembly interface boundaries are susceptible to memory and stack corruption if the native C-side signature of external functions does not match the WebAssembly types. If the signature of callbacks like wasm_on_headers_complete mismatches, it leads to unstable execution environments inside the VM boundary.