AIKIDO-2026-877398

TL;DR

res.sendFile() parses the request Range header with a hand-rolled parser that does not reject inverted or malformed ranges such as bytes=10-5. Such a range produces a negative Content-Length, and the resulting stream error reaches the default error handler, which tries to write headers after they were already sent and crashes the Node.js process. A single unauthenticated request can therefore take the whole server down. The fix parses ranges with header-range-parser, returns 416 for unsatisfiable ranges before writing headers, and stops the default error handler from writing once headers are sent.