* SECURITY UPDATE: HTTP request smuggling via improper HTTP/1 header termination in the bundled HTTP parsers - debian/patches/CVE-2025-23167.patch: restore message-framing terminator validation in both HTTP/1 parsers Node 12 bundles. In the loose (non-strict) state machine of the bundled llhttp 2.1.6, which Node compiles by default (LLHTTP_STRICT_MODE is never set): headers_almost_done, chunk_size_almost_done and the chunk_data_almost_done / chunk_data_almost_done_skip pair now require the LF (resp. CR then LF) after a CR instead of consuming any byte, and res_line_almost_done requires the LF after the response status line's CR; each accept/reject edge was derived from the loose machine's own goto graph rather than by copying the strict machine's labels, which are not interchangeable between the two halves. Node 12 additionally still bundles the legacy deps/http_parser 2.9.4 -- node.gypi links it alongside llhttp and --http-parser=legacy (also settable through NODE_OPTIONS) selects it at runtime -- and it is built with HTTP_PARSER_STRICT=0, which compiles its terminator assertions away; the same five framing checks are made unconditional there via a new FRAMING_CHECK macro. A header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT instead of silently swallowing the byte and parsing the bytes that follow as a second, smuggled request (no upstream Node.js 12 fix exists -- 12.x went EOL long before disclosure, and upstream fixed this by replacing the parser wholesale with llhttp 9; approximated from llhttp 6d04465e, PR nodejs/llhttp#234, first in llhttp v9.0.0 / Node v20.19.2) - CVE-2025-23167