http: disable request smuggling via empty headers

PR-URL: nodejs-private/node-private#427 Fixes: https://hackerone.com/reports/2001873 Refs: nodejs-private/llhttp-private#13 Reviewed-By: Matteo Collina <[email protected]> CVE-ID: CVE-2023-30589
Ethan-Arrowood · Jun 20, 2023 · 2e6de55 · 2e6de55
1 parent 4a82c8f
commit 2e6de55
Show file tree

Hide file tree

Showing 4 changed files with 634 additions and 477 deletions.
diff --git a/deps/llhttp/CMakeLists.txt b/deps/llhttp/CMakeLists.txt
@@ -1,7 +1,7 @@
 cmake_minimum_required(VERSION 3.5.1)
 cmake_policy(SET CMP0069 NEW)
 
-project(llhttp VERSION 8.1.0)
+project(llhttp VERSION 8.1.1)
 include(GNUInstallDirs)
 
 set(CMAKE_C_STANDARD 99)

diff --git a/deps/llhttp/include/llhttp.h b/deps/llhttp/include/llhttp.h
@@ -3,7 +3,7 @@
 
 #define LLHTTP_VERSION_MAJOR 8
 #define LLHTTP_VERSION_MINOR 1
-#define LLHTTP_VERSION_PATCH 0
+#define LLHTTP_VERSION_PATCH 1
 
 #ifndef LLHTTP_STRICT_MODE
 # define LLHTTP_STRICT_MODE 0