corpus.blog
41554 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a087cd-5be3-73c1-86e7-59afacafc01e

The Forgotten Bug: How a Node.js Core Design Flaw Enables HTTP Request Splitting

r3verii.github.io · published 27 February 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at r3verii.github.io Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
13
Words captured
8,338

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://nvd.nist.gov/vuln/detail/CVE-2018-12116
nvd.nist.gov
https://www.rfk.id.au/blog/entry/security-bugs-ssrf-via-request-splitting/
rfk.id.au
https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use
en.wikipedia.org
https://github.com/nodejs/node/blob/main/lib/_http_client.js
github.com
https://github.com/nodejs/node/blob/main/lib/_http_outgoing.js
github.com
https://github.com/http-party/node-http-proxy/blob/master/lib/http-proxy/passes/web-incoming.js
github.com
https://github.com/chimurai/http-proxy-middleware/blob/master/src/handlers/fix-request-body.ts
github.com
https://github.com/ladjs/superagent/blob/master/src/node/index.js
github.com
https://github.com/request/request/blob/master/request.js
github.com
https://github.com/hapijs/wreck/blob/master/lib/index.js
github.com
https://hackerone.com/nodejs
hackerone.com
https://github.com/r3verii
github.com
https://www.linkedin.com/in/martino-spagnuolo/
linkedin.com