- CVE-2025-23167: restore HTTP/1 message-framing terminator validation in both parsers Node 12 bundles. In the loose (non-strict) state machine of llhttp 2.1.6 -- the one Node compiles, since LLHTTP_STRICT_MODE is never set -- headers_almost_done, chunk_size_almost_done and the chunk_data_almost_done / chunk_data_almost_done_skip pair now require the LF (resp. CR then LF) after a CR instead of consuming any byte, and res_line_almost_done requires the LF after the response status line's CR. The legacy deps/http_parser 2.9.4, which node.gypi also links and which --http-parser=legacy (or NODE_OPTIONS) selects at runtime, is built with HTTP_PARSER_STRICT=0 and had the identical defect; its five framing assertions are made unconditional via a new FRAMING_CHECK macro. A header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT instead of swallowing the byte and parsing what follows as a second, smuggled request