CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Duplicate Advisory: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass

Hono missing validation of cookie name on write path in setCookie()

Duplicate Advisory: Hono missing validation of cookie name on write path in setCookie()

oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass

Apache CXF OAuth2 HTTP Response Splitting via WWW-Authenticate Realm Injection

cowboy and gun affected by an HTTP Request/Response Splitting vulnerability

swift-nio-http2: Missing CR/LF/NUL validation in header values

guzzlehttp/psr7 has CRLF Injection via URI Host Component

AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass

Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input

Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`

guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization

Kirby: Request header injection in `Http\Remote`

aiohttp: CRLF injection in multipart headers

Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix

eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields

Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)

Microdot has HTTP response splitting in Response.set_cookie()

i18next-http-middleware: HTTP response splitting and DoS via unsanitised Content-Language header

Axios: Header Injection via Prototype Pollution

Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTP_HOST in Message-ID email header

Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

ewe Has Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting)