Collected research

http-garden: Differential fuzzing REPL for HTTP implementations.

narfindustries · GitHub

A REPL that runs dozens of HTTP servers and proxies in containers and compares them directly: a payload is transduced through a proxy, fanned out to the origin servers, and their parsed requests are shown in an agreement grid, with benign quirks probed beforehand so only real disagreements surface. Such discrepancies are smuggling and desync bugs; the sample shows a bare LF chunk terminator that nginx accepts while Gunicorn answers 400 and Hyper drops the connection.

Record

Researcher

narfindustries

Published by

GitHub

Format

Repository

Topic

HTTP

In the archive

• Collected in the 2024 research round

Tags

• request-smuggling
• parser-differential
• fuzzing
• http
• desync
• proxy
• tooling

This page is the archive's own catalogue record. The research is the work of narfindustries, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.