- CVE-2025-23167: restore terminator validation in the loose state machine of the bundled llhttp 6.1.1 that Node compiles by default, so headers_almost_done, chunk_size_almost_done, chunk_data_almost_done and res_line_almost_done require the LF after a CR instead of consuming any byte; a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather than swallowing the byte and parsing what follows as a second, smuggled request