AIKIDO-2026-705852

TL;DR

Affected versions of the package are vulnerable to HTTP request smuggling due to a flaw in the HTTP parser. Headers beyond maxHeadersCount/maxHeaderPairs can be omitted from req.headers, req.rawHeaders, and req.headersDistinct while still being used internally for HTTP message framing. In particular, Content-Length can be hidden from userland while the request body is still delivered. Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection can therefore desynchronize requests. The fix rejects requests that exceed the configured maximum header count.