- CVE-2025-23167: restore terminator validation in the loose state machine of the bundled llhttp that Node compiles by default (the tarball's 6.0.11 is rebased to 6.1.1 by CVE-2024-22019 and CVE-2024-27982 earlier in this series), so headers_almost_done, chunk_size_almost_done, chunk_data_almost_done and res_line_almost_done require the LF after a CR instead of consuming any byte; a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather than swallowing the byte and parsing what follows as a second, smuggled request