http: do not allow OBS fold in headers by default

PR-URL: nodejs-private/node-private#558 Refs: nodejs-private/node-private#556 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> CVE-ID: CVE-2024-27982
nodejs · Apr 2, 2024 · 5d4d584 · 5d4d584
1 parent 60d2493
commit 5d4d584
Show file tree

Hide file tree

Showing 5 changed files with 456 additions and 420 deletions.
diff --git a/deps/llhttp/CMakeLists.txt b/deps/llhttp/CMakeLists.txt
@@ -1,7 +1,7 @@
 cmake_minimum_required(VERSION 3.5.1)
 cmake_policy(SET CMP0069 NEW)
 
-project(llhttp VERSION 6.1.0)
+project(llhttp VERSION 6.1.1)
 include(GNUInstallDirs)
 
 set(CMAKE_C_STANDARD 99)

diff --git a/deps/llhttp/include/llhttp.h b/deps/llhttp/include/llhttp.h
@@ -3,7 +3,7 @@
 
 #define LLHTTP_VERSION_MAJOR 6
 #define LLHTTP_VERSION_MINOR 1
-#define LLHTTP_VERSION_PATCH 0
+#define LLHTTP_VERSION_PATCH 1
 
 #ifndef LLHTTP_STRICT_MODE
 # define LLHTTP_STRICT_MODE 0