Skip to content

v1.15.5

Choose a tag to compare

View all tags
@pi0 pi0 released this 15 Jan 11:39
· 566 commits to main since this release
v1.15.5
24231b9

compare changes

Important

Security: Fixed a bug in readBody(event) and readRawBody(event) utils where certain Transfer-Encoding header formats could cause the request body to be ignored.

In some deployments (for example, behind TCP load balancers or non-normalizing proxies), this could allow request smuggling. The handling is now safe and fully compliant. (read more)

🩹 Fixes

  • readRawBody: Fix case-sensitive Transfer-Encoding check causing request smuggling risk (618ccf4)
Assets 2
Loading