AIKIDO-2026-301031
cesanta.mongoose is vulnerable to HTTP Request Smuggling
91
Critical Risk
This Affects:
cesanta.mongooseTL;DR
The built-in HTTP server detects the protocol version with an off-by-one comparison that never recognizes HTTP/1.0 requests. As a result the server accepts Transfer-Encoding: chunked on requests that a fronting HTTP/1.0 proxy frames using Content-Length. This inconsistent message-length interpretation lets externally supplied requests desync the proxy and server, smuggling a hidden request onto another client's connection. The fix corrects the version check so chunked encoding is rejected for HTTP/1.0.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the built-in HTTP server behind a reverse proxy that can interpret request boundaries differently.
Background info
cesanta.mongoose is vulnerable to HTTP Request Smuggling in versions 7.21 - 7.21.
How to fix this
Upgrade the cesanta.mongoose library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant