no-insecure-http-parser

Detects insecureHTTPParser: true on Node HTTP servers, clients and agents. This rule is part of eslint-plugin-node-security and provides LLM-optimized error messages with fix suggestions.

🚨 Security rule | 💡 Provides suggestions | ⚠️ Set to error in recommended

Quick Summary

Vulnerability and Risk

Vulnerability: Node's default llhttp parser rejects ambiguous message framing — a message carrying both Content-Length and Transfer-Encoding, an invalid chunk size, a bare LF line terminator. insecureHTTPParser: true swaps in the lenient parser, which accepts all of it.

Risk: Request smuggling needs exactly one thing: two hops that disagree about where one request ends and the next begins. A lenient parser behind a strict proxy (or the reverse) is that disagreement. An attacker prepends a request to somebody else's connection — stealing their session, poisoning the response queue, or reaching internal endpoints the proxy was supposed to gate.

Rule Details

The option name is Node-specific and has exactly one meaning, so the property itself is the finding. Anchoring there rather than on http.createServer(...) also catches the options object that is built once and passed somewhere else:

const serverOptions = { insecureHTTPParser: true }; // reported here
http.createServer(serverOptions, handler);          // …not here

Only a literal true reports. insecureHTTPParser: allowLegacy may well be false at runtime, and reporting it would be a guess.

Examples

❌ Incorrect

import http from 'http';
import https from 'https';

// Server accepts malformed framing from anything in front of it
const server = http.createServer({ insecureHTTPParser: true }, handler);

// Client trusts sloppy upstream framing — desyncs a shared proxy
https.request({ host, path, method: 'GET', insecureHTTPParser: true }, onResponse);

// Same switch, thrown later
serverOptions.insecureHTTPParser = true;

✅ Correct

import http from 'http';
import https from 'https';

// Default strict llhttp parser rejects ambiguous framing
const server = http.createServer(handler);

https.request({ host, path, method: 'GET' }, onResponse);

// Explicitly strict is fine too
http.createServer({ insecureHTTPParser: false }, handler);

Configuration

{
  rules: {
    'node-security/no-insecure-http-parser': ['error', {
      allowInTests: false
    }]
  }
}

Security Impact

Related Rules

• no-ssrf — Detect user-controlled outbound request URLs
• no-self-signed-certs — Detect disabled TLS certificate validation

Known False Negatives

Non-literal values

Why: A value this rule cannot read may be false at runtime, and reporting it would be a guess rather than a finding.

// ❌ NOT DETECTED
http.createServer({ insecureHTTPParser: process.env.LEGACY === '1' }, handler);

Mitigation: Do not make parser strictness configurable — there is no deployment where the lenient parser is the right answer.

Further Reading

• http.createServer options — insecureHTTPParser semantics
• HTTP request smuggling — PortSwigger's reference on desync attacks
• CWE-444: Inconsistent Interpretation of HTTP Requests — Official CWE entry

⚙️ Options