TLDR Tech / InfoSec
The Forgotten Bug: How a Node.js Core Design Flaw Enables HTTP Request Splitting
A long‑standing TOCTOU flaw in Node.js ClientRequest.path allows attackers to bypass CRLF validation by mutating the path after construction but before _implicitHeader() serializes the request line, enabling header injection, body injection, and full HTTP request splitting across popular proxy and HTTP client libraries with roughly 160M+ weekly downloads. Tracing the original CVE‑2018‑12116 fix pinpoints the remaining design gap, demonstrates practical exploits against common proxy patterns, and contrasts vulnerable libraries with those whose architectures naturally close the window. Node.js considers this out of scope for its threat model, shifting responsibility to library authors and application developers, who are urged to re‑validate paths, avoid exposing raw ClientRequest objects before flushing, and audit code where user input flows into req.path or proxyReq.path during this critical window.
Read the full story