Later archive addition

Node.JS Request Smuggling

Chris Tarquini

The article demonstrates request smuggling through Node.js's HTTP client by placing control characters and tab-separated request lines in an attacker-controlled path. It explains downstream parser requirements, keep-alive session risks, a hotpatch, and the upstream fix.

Record

Researcher

Chris Tarquini

In the archive

• Added to the 2016–17 archive after the original list was published

Related sources

• Upstream fix

Tags

• nodejs
• request-smuggling
• header-injection
• http
• parser-differential
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Chris Tarquini, first published at the original source. Preserved copies are kept so the citation survives its host.