-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| llhttp | npm | < 6.0.7 | 6.0.7 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from llhttp's header parsing logic accepting LF as a header delimiter instead of requiring CRLF. The function llhttp__after_headers_complete in http.c handles post-header validation. While the commit diff shows changes to Transfer-Encoding checks, the core issue resides in how header field termination was processed. The parser's failure to enforce CRLF allowed header smuggling by interpreting LF-delimited headers as valid. The high confidence comes from the CVE description explicitly linking improper delimiting to this function's logic.
KEV Misses 88% of Exploited CVEs- Get the report