Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

indutny/node-spdy

              master @ 661b14a
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

HTTP Request Smuggling: 1 prior fix. Scrutinize any change in this area.

lib/spdy/client.js: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

HTTP Request Smuggling: Improper CONNECT method handling allowed request smuggling and proxy bypass; the parser treated CONNECT as a normal request, enabling ambiguity between intermediaries and the backend.

Information Disclosure: Header compression was enabled by default in clients, exposing sensitive headers to CRIME-style compression oracle attacks; the fix disabled compression and set Z_NO_COMPRESSION.