- CVE-2025-23167: restore terminator validation in the loose state machine of the bundled llhttp 2.1.6 that Node compiles by default, so headers_almost_done, chunk_size_almost_done, the chunk_data_almost_done / chunk_data_almost_done_skip pair and res_line_almost_done require the LF (resp. CR then LF) after a CR instead of consuming any byte; a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather than swallowing the byte and parsing what follows as a second, smuggled request