The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.
{ "availability": "No subscription required", "binaries": [ { "binary_name": "libnode-dev", "binary_version": "12.22.9~dfsg-1ubuntu3" }, { "binary_name": "libnode72", "binary_version": "12.22.9~dfsg-1ubuntu3" }, { "binary_name": "libnode72-dbgsym", "binary_version": "12.22.9~dfsg-1ubuntu3" }, { "binary_name": "nodejs", "binary_version": "12.22.9~dfsg-1ubuntu3" }, { "binary_name": "nodejs-dbgsym", "binary_version": "12.22.9~dfsg-1ubuntu3" }, { "binary_name": "nodejs-doc", "binary_version": "12.22.9~dfsg-1ubuntu3" } ] }