AIKIDO-2026-10307

TL;DR

Affected versions of this package are vulnerable to HTTP request smuggling. When handling HTTP/1.1 requests containing an Upgrade header, the proxy may forward remaining connection bytes to the backend before the backend has accepted the upgrade. An attacker can exploit this behavior to append a malicious payload after the initial request, which the backend may interpret as a subsequent request. This may allow attackers to bypass proxy-level security controls, poison upstream connections or caches, and potentially perform cross-user session hijacking.