4 ms·
Node.js HTTP Request Smuggling via Empty Headers Separated by CR
- bkallus 3y agoDang; I found and reported this vulnerability on June 5 (after this report was made, but before it was made public or patched), and was told that they were already aware of the bug and working on a fix. I didn't realize I'd been beaten by only 10 days! https://github.com/aio-libs/aiohttp/issues/7312 https://github.com/aio-libs/aiohttp/issues/7312 https://github.com/nodejs/premature-disclosures/issues/4 https://github.com/nodejs/premature-disclosures/issues/4
- xeromal 3y agoFunny how that works sometimes.