description: The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.
problem types: HTTP Request Smuggling (CWE-444)
affected:
{
product: https://github.com/nodejs/llhttp
vendor: n/a
versions:
status: affected, version: Fixed in v2.1.4 and v6.0.6
}